Can the XRP Ledger's Confidential Transfers hide token amounts from the public while still letting an issuer or auditor see them, and is it live as of the latest source dated September 4, 2026?

The full answer

What do Confidential Transfers hide, and from whom?

XRPL.org’s Confidential Transfers documentation, as read on October 13, 2026, says the feature lets Multi-Purpose Token (MPT) holders keep their balances and transfer amounts private using EC-ElGamal encryption and zero-knowledge proofs [1]. Individual balances and transfer amounts are shielded from the public ledger [1]. Validators check the proofs to confirm a transaction is valid. They cannot see the amounts involved [1].

The XRPL.org release notes for xrpld 3.3.0, published August 6, 2026, describe the same design in one line: balances and transfer amounts stay verifiable on-ledger while the actual amounts are hidden from the public [2]. Because the issuer’s dedicated second account counts as a regular holder, XRPL.org says validators can enforce supply caps without decrypting confidential balances [1].

Some things stay in the open. Converting public tokens into confidential form shows the conversion amount in plaintext, and converting back makes the amount visible on the ledger again [1]. XRPL.org also warns that in low-volume use, publicly visible elements can reveal patterns, and that privacy is stronger when more participants make confidential transactions [1].

Who can still see the amounts?

Each confidential balance is encrypted several times over. The holder’s copy sits under the holder’s own key and carries the right to spend. A second copy sits under the issuer’s key, which XRPL.org describes as an encrypted mirror for supply verification and compliance that grants no spending power [1]. If the issuer configures an auditor, a third copy is encrypted under the auditor’s public key [1].

That gives two audit routes. In on-chain selective disclosure, an auditor such as a regulator decrypts and checks balances itself, without needing the issuer or the holder to cooperate [1]. In issuer-mediated auditing, the issuer hands over its own private key, which gives read-only access to all confidential balances and transaction amounts. XRPL.org notes that this second route requires the auditor to trust that the issuer is providing complete and accurate information [1].

Issuers keep a clawback tool as well. The ConfidentialMPTClawback transaction lets an issuer claw back a holder’s entire confidential balance [1]. These controls sit alongside the ledger’s other tools covered in what compliance features the XRP Ledger offers institutions.

What limits does the design set?

Confidential transfers work only for direct payments between accounts. XRPL.org’s documentation says they do not work with the XRP Ledger DEX, escrows or checks [1]. The token issuance must carry a transfer fee of 0, since fees cannot be applied to encrypted amounts [1].

Key choices are fixed early. The issuer registers its key, and optionally an auditor’s key, when it enables the feature, and no key can be registered once any confidential balance is in circulation [1]. Issuer and auditor keys cannot be changed or cleared after registration, and a holder who loses their private key loses their confidential funds permanently [1].

XRPL.org also states that the encryption method is not considered quantum-safe, and that the path and timeline to quantum resistance remain an open area of research [1]. The wider question is covered in whether XRP’s cryptography is at risk from quantum computers.

Is the feature live on the XRP Ledger mainnet?

The feature requires the ConfidentialTransfer amendment [1]. XRPL.org’s xrpld 3.3.0 release on August 6, 2026 introduced that amendment, listing it as privacy-preserving Multi-Purpose Token transfers under XLS-0096 [2]. The other changes in that release are set out in what is new in xrpld 3.3.0.

Ripple had given earlier timing. On February 5, 2026, Ripple wrote that Confidential Transfers for MPTs were “to be released in Q1” [4].

A software release only makes the code available. CaptainAltcoin made that point about Confidential Transfers on September 10, 2026, writing that being included in XRPL software is not the same thing as being active on mainnet [3]. Activation depends on validator votes, a process explained in how XRP Ledger amendments get approved. XRPL.org’s 3.3.0 notes and its Confidential Transfers documentation give no activation date and no validator vote count [1][2].

What argues for caution?

The documentation’s own caveats are the first check on the privacy claim. Conversion amounts are public, thin usage can leak patterns, and the issuer-shared audit route rests on trusting the issuer [1].

Recent history on other amendments points the same way. XRPL.org’s blog lists a vulnerability disclosure report titled “XRPL Batch Amendment – Unauthorized Inner Transaction Execution” among its 2026 posts [5]. XRPL.org’s August 6, 2026 release notes for xrpld 3.3.0 say BatchV1_1 fixes and replaces the original Batch amendment disabled in v3.1.1, and that PermissionDelegationV1_1 replaces the original PermissionDelegation amendment, fixing a critical bug found in the original implementation [2]. The Batch case is covered in the vulnerability XRPL Labs reported in the Batch amendment.