XPR Network suffers $9M proton.swaps exploit – Can confidence recover?

XPR Network, a layer 1 blockchain, was exploited after the attacker drained about 1.56 billion XPR, worth roughly $4.03 million, from proton.swaps.

The attacker exploited a flaw in its withdrawal function, which accepted negative amounts. This enabled the attacker to manipulate internal balances before withdrawing real tokens.

The attacker then applied this technique across multiple asset pools, including XUSDC, XMD, METAL, LOAN, and bridged assets. Within just 11 minutes of the launch of the attack, the attacker stole more than $9 million in liquidity.

Meanwhile, 563 million XPR worth roughly $1.46 million moved through the LOAN protocol after the attacker borrowed against stolen stablecoins. That raised the total XPR touched to roughly 2.12 billion, or 6.5% of the circulating supply.

Later on, the attacker moved 764 million XPR, worth roughly $1.98 million, and 150,000 METAL, worth approximately $195,000, to another account.

Network producers later identified the exploit and patched the contract. Ultimately, the incident shows how weak input validation can quickly amplify losses across interconnected liquidity pools.

XPR sell-off tests market confidence

The on-chain drain quickly spilled into XPR’s price action, with sellers taking control as confidence weakened. On the 11th of September, the XPR traded near $0.00276 before falling sharply the following day.