David Schwartz Says XRP Ledger Stayed Online During a Network-Wide Attack

David “JoelKatz” Schwartz said his $XRP Ledger hub has fully recovered from the problems that followed a network-wide attack earlier this year. “All issues with my hub have been fixed and it has been rock solid for the past two weeks,” Schwartz wrote on X. He also said two blank sections in recent monitoring charts resulted from problems with the monitoring system rather than the hub itself.

The update provides a new look at the July 2026 manifest-flood attack, which disrupted peer connectivity across XRPL without halting or forking the ledger. Recent hub data now shows relatively stable peer connections, lower abuse-related disconnects and generally latency following emergency software fixes.

Schwartz’s Hub Data Shows Stable Connections

Schwartz’s latest metrics show 406 current peer connections, compared with an average of 401.12 between Aug. 25 and Sept. 8. Peer counts ranged from 352 to 423 during that period. Inbound connections reached 135, while outbound peers stood at 271.

Latency also remained generally contained. Median peer latency measured 167.80 milliseconds, close to its 165.69-millisecond average. The 90th percentile stood at 310.67 milliseconds, although it reached 1.49 seconds during the monitoring period.

Peer disconnections currently stand at 73 per five minutes, below the period average of 84.6. Abuse-related disconnects remain lower at about 0.67 per five minutes.

XRPL Attack Triggered Mass Peer Disconnects

The attack began on July 30 targeting XRPL’s peer-to-peer communication layer rather than its consensus mechanism. Attackers flooded the network with large volumes of fake or unverified validator manifests. These cryptographic credentials allow validators to announce changes to their master keys or temporary signing keys.

However, the xrpld software lacked sufficient resource limits for processing large volumes of untrusted manifests. As nodes attempted to verify, track and store the incoming data, pressure increased on CPU and memory resources.

Nodes responded by disconnecting peers to protect themselves from resource exhaustion. The disruption affected major hubs, including Ripple-operated infrastructure and XRPSCAN. Still, XRPL continued closing ledgers.

Why $XRP Ledger Avoided a Halt or Fork

The attack weakened peer connectivity without breaking the network’s consensus process. XRPL validators rely on trusted participants on their Unique Node Lists to agree on transactions. Although some peer routes failed, enough connectivity remained between validators for consensus proposals to continue circulating.

Network redundancy also limited the impact. Nodes maintained multiple peer connections, allowing traffic to move through alternative routes when individual links dropped. Core validators could also rely on prioritized or reserved peer relationships.

Developers responded with emergency software changes, including version 3.3.0-rc6 and the 3.2.1 hotfix released July 31 to restrict untrusted manifest processing.

However, Schwartz’s hub metrics represent one infrastructure view and do not prove that XRPL is immune to future disruption. The July incident showed that peer connectivity can still be degraded at scale, and network resilience depends on software fixes, validator connectivity, peer diversity, and continued operator response. A different attack affecting consensus-critical components could produce different results.

Related: BIS Tests $XRP Ledger for Data Verification, $XRP Price Climbs 5%