Proton.Swaps Exploit Hits XPR Network for $9M; Token Slides 6.5%

XPR Network, a layer-1 blockchain, suffered a major exploit tied to proton.swaps after an attacker abused a bug in the platform's withdrawal logic. The function reportedly accepted negative amounts, allowing the attacker to distort internal accounting before pulling out legitimate tokens. The attacker initially drained about 1.56 billion XPR, valued at roughly $4.03 million, then repeated the method across several pools including XUSDC, XMD, METAL, LOAN and various bridged assets. In about 11 minutes from the start of the attack, more than $9 million in liquidity was taken. Onchain data also showed 563 million XPR (about $1.46 million) moving through the LOAN protocol after the attacker borrowed against stolen stablecoins. That brought the total amount of XPR involved to about 2.12 billion, equivalent to roughly 6.5% of circulating supply. The attacker later transferred 764 million XPR (around $1.98 million) and 150,000 METAL (about $195,000) to another account. Network producers subsequently identified the exploit and patched the contract, highlighting how weak input validation can rapidly magnify losses across interconnected liquidity pools. Market impact: XPR selloff pressures sentiment The drain quickly fed into price action. On Sept. 11, XPR traded near $0.00276 before sliding the next day. The selloff drove an intraday low around $0.00242, a drop of about 6.5%. Buyers later lifted the token toward $0.00259, though the rebound remained constrained as XPR stayed below the $0.00271 support level. Momentum indicators reflected the stress: RSI fell to 27.47, indicating oversold conditions and intense selling pressure. Turnover climbed toward $4 million. A more durable recovery would likely require XPR to reclaim $0.00271 and stabilize sentiment. Most affected funds secured Post-exploit flows suggested losses were largely containable. Of the 2.12 billion XPR touched, about 1.80 billion remained in attacker-controlled accounts, while 319.5 million XPR reached external venues. Producers applied a contract patch at 21:32 UTC. At 23:26 UTC, they seized the 1.80 billion XPR and placed it under community control, leaving most of the affected funds potentially recoverable. By Sept. 13, XPR was trading around $0.00261–$0.00262, signaling that selling pressure had eased. With most funds now secured, attention turns to whether XPR Network can rebuild liquidity and restore user confidence. Final take: XPR Network lost about $9 million in the proton.swaps exploit. XPR fell 6.5% before stabilizing, and the majority of impacted XPR was secured, shifting the focus to liquidity recovery and trust.