Ripple’s Veteran Schwartz Discloses Private XRP Ledger Hub Health After Network-Wide Attack

Ripple CTO Emeritus and XRP Ledger chief architect David Schwartz has revealed the operational metrics of his private hub — essentially a major relay server through which other network nodes communicate.

The telemetry covers the period from August 25 to September 8, and validators’ interest in it is no coincidence: this is one of XRPL’s key nodes. The Ripple veteran’s verdict is that the system has fully recovered from the recent crisis and is operating with rock-solid stability, or, as Schwartz himself put it, “Rock Solid.”

For the ecosystem, this publication is more than just a set of dry charts — it is a long-awaited seal of approval. Just over a month ago, on July 31, the XRPL network suffered a serious infrastructure crisis.

How one spam attack nearly overloaded the XRP network and why its creator had to personally prove that everything had been fixed

Anonymous attackers launched a so-called “manifest storm.” A manifest is the digital credential of a validator node, and the attackers flooded the network with thousands of fake credentials, forcing nodes to spend resources processing garbage.

At the time, Schwartz’s hub suffered widespread connection failures with an onReadMessage error directly at the agreement stage — the point at which nodes compare the state of the ledger with one another. However, block finalization and consensus itself were not interrupted for even a minute, and the incident was resolved through emergency engineering intervention without shutting down the network.

Developers had to rush out the xrpld 3.2.1 hotfix. It limited manifest sizes and reworked data caching for unknown nodes so that the system would no longer waste resources on suspicious participants. A month later, Schwartz presented the first results of the patch under real-world conditions.

The latest charts prove that the consequences of the attack have been completely eliminated. The hub reliably maintains around 400 simultaneous connections, peaking at 423, including 135 inbound and 271 outbound connections. Latency — the response time between nodes — fell to 165 milliseconds.

The only anomaly was a one-off spike to 1.49 seconds on September 6, but the algorithms contained it without affecting consensus. Connection drops remained at 84.6 incidents per five-minute interval — a normal background rate rather than a sign of trouble. The malicious activity metric, labeled “Abuse,” fell to nearly zero, as the updated protection now filters out almost all garbage traffic.

In essence, this is not a routine uptime report for a single server, but a public audit of the updated xrpld software under real-world load. It confirms that XRPL’s infrastructure is ready for long-term, stable operation.