Swap

DeFi

Record

XPR Network

<p>An attacker drained more than $9 million from liquidity pools on <strong>XPR Network</strong><a href="https://yellow.com/asset/xpr" rel="noopener noreferrer nofollow">(XPR)</a> in 11 minutes, exploiting a swap contract that accepted negative withdrawal amounts.</p>
<h2 id="key-points">Key Points:</h2>
<blockquote>
 <ul>
  <li>An attacker pulled more than $9 million out of XPR Network liquidity pools in roughly 11 minutes.</li>
  <li>The flaw sat in a withdrawal function that accepted negative values, letting the attacker inflate internal balances before taking real tokens.</li>
  <li>Block producers patched the contract and seized about 1.80 billion XPR, keeping most of the stolen supply on-chain.</li>
 </ul>
</blockquote>
<h2 id="xpr-network-swap-exploit">XPR Network Swap Exploit</h2>
<p>The attack targeted proton.swaps, the network's on-chain swap contract, where the attacker <a href="https://ambcrypto.com/xpr-network-suffers-9m-proton-swaps-exploit-can-confidence-recover/" rel="noopener noreferrer nofollow">drained</a> about 1.56 billion XPR worth roughly $4.03 million. Its withdrawal function accepted negative values. That let the attacker inflate an internal balance and then pull real tokens against it, a trick repeated across stablecoin, bridged-asset and lending pools until the running total passed $9 million.</p>
<p>Roughly 563 million XPR, worth some $1.46 million, then moved through the lending protocol after the attacker borrowed against the stolen stablecoins, lifting the tokens touched to about 2.12 billion, or 6.5% of circulating supply. Another 764 million XPR, worth close to $2 million, later moved to a second account.</p>
<p><strong>Also Read:</strong><a href="https://yellow.com/news/xrp-etfs-record-inflow-streak" rel="noopener noreferrer nofollow">XRP ETFs Hit $1.7B Record As 9-Week Inflow Streak Defies Price Weakness</a></p>
<h2 id="xpr-price-slides-below-support">XPR Price Slides Below Support</h2>
<p>The drain reached the market within hours. XPR <a href="https://www.bybit.com/en/price/proton/" rel="noopener noreferrer nofollow">slipped</a> to about $0.0026 on Sunday, down roughly 5.6% over 24 hours after touching a low near $0.00245, and it stayed below the $0.00271 level that had been acting as support. The token had changed hands as high as $0.00277 earlier in the same session, and its market value fell to around $74 million.</p>
<p>The <a href="https://yellow.com/learn/the-relative-strength-index-rsi-what-it-is-and-how-it-works" rel="noopener noreferrer nofollow">RSI</a> sank to 27.47, deep in oversold territory. That reading points to one-way selling rather than an orderly repricing, and turnover of roughly $2.9 million across the day left buyers thin on the ground.</p>
<p>The sum is small next to this year's largest DeFi losses. The failure mode matters more than the total, because one missing check on input values let damage spread out of a single swap contract and into lending and bridged-asset pools that shared the same liquidity. The attacker needed no flash loan and no oracle manipulation, only a minus sign the contract never rejected.</p>
<h2 id="metallicus-freezes-stolen-xpr">Metallicus Freezes Stolen XPR</h2>
<p>Block producers patched the contract at 21:32 UTC and seized roughly 1.80 billion XPR about two hours later, placing the tokens under community control. Only 319.5 million XPR, out of the 2.12 billion touched, ever reached venues beyond the network.</p>
<p>Most of the affected supply therefore stays recoverable, an outcome available because XPR Network runs on delegated proof-of-stake, where a small group of elected producers can act directly on the chain's state. The network has reached for that lever before.</p>
<p><strong>Metallicus</strong>, the core developer behind XPR Network, <a href="https://metalx.com/news/loan-protocol-update" rel="noopener noreferrer nofollow">reported</a> a re-entrancy exploit against its lending contract in September 2024, halted deposits, borrowing and liquidations, froze the affected funds and reopened lending in phases the following month.</p>
<p><strong>Read Next:</strong><a href="https://yellow.com/news/altman-rules-out-2026-openai-ipo" rel="noopener noreferrer nofollow">Sam Altman Rules Out A 2026 OpenAI IPO And Blames AI Safety Work</a></p>

XPR Network Bled $9M Through A Contract That Accepted Minus Signs

Table of Contents

Yellow News

Other articles published on Sep 14, 2026

Join our free newsletter for daily crypto updates!