XPR Network, a layer 1 blockchain, experienced a significant security breach affecting the proton.swaps protocol. Attackers exploited a flaw in the withdrawal function that accepted negative amounts, allowing them to manipulate internal balances and drain liquidity across multiple asset pools.
The attack yielded approximately 1.56 billion XPR tokens worth roughly $4.03 million directly from proton.swaps. The attacker then applied the same technique across pools including XUSDC, XMD, METAL, LOAN, and bridged assets, accumulating more than $9 million in liquidity within 11 minutes.
An additional 563 million XPR worth approximately $1.46 million moved through the LOAN protocol after the attacker borrowed against stolen stablecoins. The total XPR affected reached 2.12 billion tokens, representing 6.5% of the circulating supply. The attacker subsequently transferred 764 million XPR and 150,000 METAL tokens to another account.
Network Response and Fund Recovery
Network producers identified the exploit and patched the contract, limiting damage. Of the 2.12 billion XPR tokens involved in the attack, approximately 1.80 billion remained in attacker-controlled accounts and only 319.5 million reached external venues. This containment enabled producers to act before additional funds left the network.
At 21:32 UTC, producers applied a patch to their contract. At 23:26 UTC, they seized the 1.80 billion XPR and placed it under community control, making most affected funds recoverable.
Market Impact
The exploit triggered immediate selling pressure. On September 11, XPR traded near $0.00276 before falling to an intraday low of approximately $0.00242 on September 12, a decline of about 6.5%. Buyers subsequently lifted the price toward $0.00259, though it remained below the $0.00271 support level. By September 13, XPR stabilized near $0.00261–$0.00262, indicating easing selling pressure. The Relative Strength Index fell to 27.47, indicating oversold conditions, while trading turnover approached $4 million.
The incident demonstrates how weak input validation can amplify losses across interconnected liquidity pools. With most funds secured, attention now turns to whether XPR can rebuild user confidence and restore network liquidity.
