XPR Network Suffers $9M Loss from Proton.Swaps Exploit

XPR Network, a layer 1 blockchain, fell victim to an exploit on its proton.swaps platform. The attacker manipulated internal balances by accepting negative withdrawal amounts, draining around $9 million in liquidity from various asset pools.

The exploit occurred just 11 minutes after the launch of the attack and affected assets including XUSDC, XMD, METAL, LOAN, and bridged assets. Approximately 1.56 billion XPR was stolen, valued at roughly $4.03 million, with the attacker using this to manipulate balances before withdrawing real tokens.

The incident highlights the risks of weak input validation in interconnected liquidity pools, allowing a small exploit to amplify losses rapidly. Network producers identified and patched the contract, but not before the attacker moved 563 million XPR worth $1.46 million through the LOAN protocol and another 764 million XPR worth $1.98 million to an external account.

The attack led to a sharp decline in XPR's price, falling by around 6.5% on September 12th. However, buyers stepped in after the drop, lifting XPR back towards its previous level but failing to reclaim the key support level of $0.00271. Trading activity increased, with turnover approaching $4 million.