The XRP Centralization Debate Is Asking the Wrong Question

Every few months, someone declares the XRP centralization debate reopened, and the same two numbers do the arguing. On one side, Ripple's critics point out that the ledger's security ultimately hangs on a short list of trusted validators that Ripple helped curate. On the other, Ripple's defenders note how few of those validators Ripple actually operates. Both sides are partly right, and both are talking past each other, because they are measuring the wrong thing. The score that matters for an XRP holder is not who runs the nodes. It is who decides which nodes count at all.

The surface answer: Ripple runs almost none of the network

Start with the number that favors Ripple. The XRP Ledger reaches agreement through a fixed set of validators that every other node trusts, not through the open competition of proof-of-work or proof-of-stake. Within that trusted set, Ripple itself has shrunk to a small minority. By 2023 the company operated roughly two of the roughly 35 validators on the recommended list. It has also committed to dropping one of its own validators for every two third-party operators added. By that count, "Ripple controls the network" is plainly false, and it has been for years.

The actual control point is the list, not the nodes

The problem with that accounting is that it mistakes the operators for the mechanism. Each XRP server comes preconfigured to trust a "default" Unique Node List (dUNL) — a vetted set of validators it downloads and obeys by default. Running validators gives you a voice in each round; curating the list gives you a say in whose voices are even heard. And the ledger's own design makes curation unusually powerful. Consensus requires a high degree of overlap among what different servers trust — in the worst case, about 90%— so a node operator cannot meaningfully improvise its own list without falling out of alignment with the network. The practical effect is that the publisher of the recommended list functions as a gatekeeper, and most operators accept its choices.

That is the arrangement Justin Bons, founder of the crypto fund Cyber Capital, attacks. His charge is blunt: a network whose validators are effectively "permissioned" by a centrally published list is centralized by definition. The publisher, he contends, can isolate any node that doesn't align with it. Ripple's longtime CTO Emeritus, David Schwartz, does not dispute the mechanism. He disputes the inference, arguing that validators cannot force an honest node to accept a bad transaction and that nodes pick their own lists. His revealing concession is that Ripple deliberately designed the system so that it would not control the network — a choice he ties to the SEC's lawsuit over XRP sales, saying Ripple had to be able to honor U.S. court orders without conflicts of interest. By that reading, "decentralization" is positioning the company chose for its own legal safety as much as a property of the software.

The one change that actually matters

This is where the debate, for all its noise, has been moving in real time. For most of the ledger's life, Ripple was the natural custodian of the default list — its own node, vl.ripple.com, was one of the two sources most servers trusted. That is exactly the control point Bons complained about. But stewardship has since migrated. In September 2025, the XRPL Foundation took over curation of the default list, moving it to a new signed URL under its own control and setting a hard shutdown date for the old Ripple-era endpoint on September 30, 2025.

That handoff is the most consequential fact in the debate, and neither side quotes it. It does not make XRP a proof-of-stake or proof-of-work network; it does not remove the single curated list that constitutes the ledger's real authority. It changes who holds the pen — from the company accused of centralizing the network to a separate foundation aligned with the same ecosystem — while leaving the structural reliance on a curated trust list untouched. The modest, honest way to describe it: Ripple's operational grip has weakened further, and the one remaining point of central control has been handed from the accused to a caretaker.

What this means for an XRP investor

The useful lesson is that "decentralized" and "centralized" are the wrong two boxes for XRP. What the ledger actually offers is fast, cheap agreement — roughly five-second settlement— because its security comes from social trust in a small federated set rather than from expensive competition between miners or stakers. That tradeoff is the product. The price the network pays is that its continued integrity depends on the competence, independence, and coordination of a very small group of curators and the operators who default to them. That is a governance and regulatory risk, not a technical one, and the riskiest versions of it are slow-moving: a list publisher that loses independence, a foundation that becomes a rubber stamp, or operators continuing to accept defaults without scrutiny.

Seen that way, the recurring centralization debate is less an indictment than a reminder of what you are actually buying. The September 2025 migration is genuine progress — real authority did leave Ripple's hands — but it moves the load-bearing trust point, it does not dismantle it. XRP is still a network whose final authority rests on a short curated list that virtually every node accepts by default. Whatever the debate says next time, that is the fact to watch: not how many validators Ripple runs, but who curates the list everyone else trusts.