XPR Network suffered a $9 million exploit after an attacker exploited a withdrawal function flaw that accepted negative amounts. The attacker drained 1.56 billion XPR from proton.swaps and manipulated multiple pools. Network producers patched the contract and later seized 1.80 billion XPR, placing it under community control. XPR’s price fell 6.5% before stabilizing near $0.00262. The incident highlights weak input validation risks.
XPR Network, a layer 1 blockchain, was exploited after an attacker drained about 1.56 billion XPR, worth roughly $4.03 million, from proton.swaps. The attacker exploited a flaw in its withdrawal function, which accepted negative amounts, enabling manipulation of internal balances before withdrawing real tokens.
The attacker applied this technique across multiple asset pools, including XUSDC, XMD, METAL, LOAN, and bridged assets. Within just 11 minutes of the launch of the attack, the attacker stole more than $9 million in liquidity.
Meanwhile, 563 million XPR worth roughly $1.46 million moved through the LOAN protocol after the attacker borrowed against stolen stablecoins, raising total XPR touched to roughly 2.12 billion, or 6.5% of circulating supply. Later, the attacker moved 764 million XPR, worth roughly $1.98 million, and 150,000 METAL, worth approximately $195,000, to another account.
Network producers later identified the exploit and patched the contract at 21:32 UTC. At 23:26 UTC, producers seized the 1.80 billion XPR and placed it under community control.
The on-chain drain quickly spilled into XPR’s price action. On September 11, XPR traded near $0.00276 before falling sharply the following day to an intraday low near $0.00242, a decline of about 6.5%. Buyers stepped in after the drop, lifting XPR back toward $0.00259, but the token remained below the $0.00271 support level. The RSI fell to 27.47, placing XPR in oversold territory with heavy selling pressure, while trading activity increased with turnover approaching $4 million.
With most funds secured, the focus now shifts to whether XPR can rebuild liquidity and user confidence.
