$XPR Network Exploit Drains $9 Million from Proton Swaps
$XPR Network, a layer 1 blockchain, suffered a major exploit after an attacker drained approximately 1.56 billion $XPR tokens, valued at roughly $4.03 million, from proton.swaps. The attacker exploited a critical flaw in the withdrawal function that accepted negative amounts, enabling manipulation of internal balances before withdrawing real tokens.
Attack Spreads Across Multiple Asset Pools
The attacker applied this technique across multiple asset pools, including XUSDC, XMD, METAL, LOAN, and bridged assets. Within just 11 minutes of launching the attack, the exploiter stole more than $9 million in liquidity.
Subsequently, 563 million $XPR worth roughly $1.46 million moved through the LOAN protocol after the attacker borrowed against stolen stablecoins. This raised the total $XPR touched to roughly 2.12 billion, representing approximately 6.5% of the circulating supply.
Later, the attacker moved 764 million $XPR (worth roughly $1.98 million) and 150,000 METAL (worth approximately $195,000) to another account. Network producers identified the exploit and patched the contract, highlighting how weak input validation can rapidly amplify losses across interconnected liquidity pools.
$XPR Sell-Off Tests Market Confidence
The on-chain drain quickly spilled into $XPR’s price action, with sellers taking control as confidence weakened. On September 11, $XPR traded near $0.00276 before falling sharply the following day. The sell-off pushed the price to an intraday low near $0.00242, marking a decline of about 6.5%. However, buyers stepped in after the drop, lifting $XPR back toward $0.00259. That rebound remained limited because the token traded below the $0.00271 support level.
Meanwhile, the Relative Strength Index (RSI) fell to 27.47, placing $XPR in oversold territory and signaling heavy selling pressure. Trading activity increased, with turnover approaching $4 million. The rebound signals buying interest, but sustained recovery requires $XPR to reclaim $0.00271 and stabilize sentiment.
Producers Secure Majority of Affected Funds
The funds’ movement after the exploit offers a clearer picture of the damage and recovery prospects. Of the 2.12 billion $XPR touched, about 1.80 billion remained in attacker-controlled accounts. Only 319.5 million $XPR reached external venues, limiting the amount that moved beyond network control. This allowed producers to take action prior to any additional $XPR leaving the network. Producers applied a patch to their contract at 21:32 UTC.
Then, at 23:26 UTC, producers seized the 1.80 billion $XPR and placed it under community control. As a result, most of the affected funds remained recoverable. $XPR also stabilized near $0.00261–$0.00262 on September 13, suggesting selling pressure had eased.
Focus Shifts to Rebuilding Liquidity and Trust
With most funds secured, the focus now shifts to whether $XPR can rebuild liquidity and user confidence. The incident underscores the critical importance of robust input validation in smart contract design, particularly for protocols managing interconnected liquidity pools.
Key Takeaways
- $XPR Network lost $9 million in the proton.swaps exploit, while $XPR fell 6.5% before stabilizing.
- Most stolen $XPR was secured by network producers, leaving the network focused on restoring liquidity and trust.
- The exploit originated from a withdrawal function accepting negative amounts, enabling balance manipulation across multiple pools.
- Producers patched the contract and seized 1.80 billion $XPR within hours, placing funds under community control.
