The two biggest DeFi exploits in the past two months shared one thing in common: they used a tool that does not exist on the XRP Ledger. On May 15, Thorchain lost roughly $10.8 million in a cross-chain attack that drained funds across Bitcoin, Ethereum, BSC, and Base. Drift Protocol, a Solana-based decentralized perpetual exchange, and KelpDAO, an Ethereum liquid restaking protocol, together accounted for over $600 million in losses through April alone.
Cross-chain bridges have lost more than $2.8 billion to attacks since 2021, per Chainalysis. A significant share of those exploits used variants of the same mechanic: flash loans. A flash loan lets a trader borrow millions with no collateral, as long as the loan is repaid inside the same transaction. Legitimate use cases include arbitrage, collateral swaps, and liquidation bots. Attackers weaponize the same flow—borrow, manipulate an oracle or a poorly designed pool, profit, repay—and risk only gas fees if any step fails.
The XRP Ledger blocks this. A draft amendment filed this week on the XRPL standards repository proposes concentrated liquidity and StableSwap-style pools for the chain's native AMM. Its Security Considerations section includes one line: "Flash loan attacks are structurally impossible. XRPL transactions are atomic without composable intra-transaction calls."
XRPL transactions either fully succeed or fully fail, like Ethereum. But unlike Ethereum, an XRPL transaction cannot call another contract during execution. The borrow-manipulate-repay sequence that defines a flash loan attack needs at least three nested operations inside a single transaction envelope—impossible on XRPL.
A Trade-off With a Price Tag
This architectural choice has a cost. Flash loans are not just attack vectors. Aave, dYdX, and others offer them as a product. Arbitrage traders use them to clear price differences atomically. Liquidation bots rely on them to keep over-collateralized positions solvent. Sophisticated DeFi users use them for collateral swaps that would otherwise lock up capital for hours. XRPL gives up all that utility in exchange for closing an entire attack class.
For most of XRPL's history, the trade-off barely mattered because the chain's DeFi footprint was small. That is changing. Tokenized real-world assets on XRP Ledger have crossed $3 billion, including a Ripple–JPMorgan–Mastercard–Ondo Finance pilot last month that processed a tokenized U.S. Treasury redemption in under five seconds.
If the AMM amendment passes and XRPL DeFi liquidity grows toward institutional scale, the question is whether structural exploit resistance becomes a real edge—or a feature institutions ignore in favor of where the liquidity already sits.