An attacker drained more than $9 million from liquidity pools on XPR Network (XPR) in 11 minutes, exploiting a swap contract that accepted negative withdrawal amounts.
Key Points:
- An attacker pulled more than $9 million out of XPR Network liquidity pools in roughly 11 minutes.
- The flaw sat in a withdrawal function that accepted negative values, letting the attacker inflate internal balances before taking real tokens.
- Block producers patched the contract and seized about 1.80 billion XPR, keeping most of the stolen supply on-chain.
XPR Network Swap Exploit
The attack targeted proton.swaps, the network's on-chain swap contract, where the attacker drained about 1.56 billion XPR worth roughly $4.03 million. Its withdrawal function accepted negative values. That let the attacker inflate an internal balance and then pull real tokens against it, a trick repeated across stablecoin, bridged-asset and lending pools until the running total passed $9 million.
Roughly 563 million XPR, worth some $1.46 million, then moved through the lending protocol after the attacker borrowed against the stolen stablecoins, lifting the tokens touched to about 2.12 billion, or 6.5% of circulating supply. Another 764 million XPR, worth close to $2 million, later moved to a second account.
Also Read: XRP ETFs Hit $1.7B Record As 9-Week Inflow Streak Defies Price Weakness
XPR Price Slides Below Support
The drain reached the market within hours. XPR slipped to about $0.0026 on Sunday, down roughly 5.6% over 24 hours after touching a low near $0.00245, and it stayed below the $0.00271 level that had been acting as support. The token had changed hands as high as $0.00277 earlier in the same session, and its market value fell to around $74 million.
The RSI sank to 27.47, deep in oversold territory. That reading points to one-way selling rather than an orderly repricing, and turnover of roughly $2.9 million across the day left buyers thin on the ground.
The sum is small next to this year's largest DeFi losses. The failure mode matters more than the total, because one missing check on input values let damage spread out of a single swap contract and into lending and bridged-asset pools that shared the same liquidity. The attacker needed no flash loan and no oracle manipulation, only a minus sign the contract never rejected.
Metallicus Freezes Stolen XPR
Block producers patched the contract at 21:32 UTC and seized roughly 1.80 billion XPR about two hours later, placing the tokens under community control. Only 319.5 million XPR, out of the 2.12 billion touched, ever reached venues beyond the network.
Most of the affected supply therefore stays recoverable, an outcome available because XPR Network runs on delegated proof-of-stake, where a small group of elected producers can act directly on the chain's state. The network has reached for that lever before.
Metallicus, the core developer behind XPR Network, reported a re-entrancy exploit against its lending contract in September 2024, halted deposits, borrowing and liquidations, froze the affected funds and reopened lending in phases the following month.
Read Next: Sam Altman Rules Out A 2026 OpenAI IPO And Blames AI Safety Work
