Ripple’s developer arm has floated a blueprint to bring privacy-coin-like functionality to the XRP Ledger—without abandoning the network’s long-standing emphasis on public supply integrity and compliance tooling.
In a new XRP Ledger Standards (XRPLF) discussion opened on September 13, Ripple engineers Murat Cenk and Aanchal Malhotra propose “Confidential Multi-Purpose Tokens (MPTs),” an amendment that would encrypt balances and transfer amounts using EC-ElGamal and zero-knowledge proofs, while preserving the accounting semantics of XRPL’s existing MPT framework. RippleX subsequently highlighted the proposal on X, drawing mainstream attention to what could be the most consequential privacy addition yet considered for XRPL.
Is XRP Becoming A Privacy Coin?
At its core, the draft introduces confidentiality at the token layer without obscuring aggregate supply.
Confidential MPTs provide confidential transfers and balances using EC-ElGamal encryption and Zero-Knowledge Proofs (ZKPs), while preserving XLS-33 semantics,” the authors write. Crucially, they stress that “Public auditability” remains intact because issuance limits continue to be enforced by the network’s existing invariant—OutstandingAmount never exceeding MaxAmount—so validators can verify that no new tokens are silently minted even if individual balances are encrypted.
The design leans on a practical architectural compromise. Instead of redefining supply math for a private system, issuers would maintain a designated “second account” that the ledger treats like any other holder. Public supply metrics, including OutstandingAmount, then account for both public and confidential balances, with a new ConfidentialOutstandingAmount field tracking the private portion. This lets validators enforce the same XLS-33 rule set they already understand, while transactions themselves rely on equality proofs and range proofs to ensure spends are valid without revealing amounts.
The proposal is explicit about the “twist” that differentiates it from pure privacy chains such as Monero or Zcash: selective disclosure and issuer controls are built in. The spec outlines two auditor models—an on-chain, trust-minimized approach that supports pre-defined auditors and later additions via re-encryption, and a simpler issuer-controlled “view key” option. It also proposes issuer-only freeze and clawback capabilities over confidential balances, framed as compliance tools rather than discretionary surveillance. In the authors’ words, the system enables “flexible auditability” while keeping private balances “encrypted under the holder’s key,” with optional auditor copies of the same ciphertext verifiably bound via ZK equality proofs.
To make the flow reliable at scale, the draft adopts a split-balance model that separates a holder’s encrypted funds into a spendable “Spending” balance and an “Inbox” for new incoming transfers. A lightweight merge operation prevents “stale proof” failures that can occur when a new receipt lands while a user is preparing a proof for an outgoing transfer. That operational detail, commonplace in high-throughput confidential systems, suggests the authors are mindful of UX and wallet-developer realities, not just cryptographic elegance.
If advanced, the change would arrive as an XRPL amendment and need to clear the ledger’s formal governance hurdle: more than 80% validator approval sustained for two weeks before activation on mainnet. Nothing in the discussion implies a live vote yet; the status is “Discussion,” and any production path would first require code landing in a stable server release.
Context matters here. The multi-purpose token standard (XLS-33, “MPT”) already equips XRPL with a more compact, compliance-aware fungible token primitive than legacy trustlines, including allow-lists, freeze and clawback, and on-chain metadata. Confidential MPTs don’t replace that model; they extend it. The ledger would continue to expose supply caps and enforce invariants even as per-account balances become opaque, aiming squarely at institutional tokenization where privacy, auditability, and policy controls must coexist.
Technically—and politically—the framing invites the obvious question in the headline. Is XRP becoming a privacy coin? The honest answer is ambivalent by design. On one hand, balances and amounts would be encrypted end-to-end, with ZKPs securing the flow—indistinguishable at a glance from what privacy coins promise. On the other hand, the draft hardwires audit channels and issuer recourse that privacy-maximalist communities typically reject, and it preserves validator-enforced supply checks that make “stealth inflation” mathematically impossible. That is the “Yes—and No” in a nutshell.
At press time, XRP traded at $3.01.
