11 Minutes to Ruin: How a Negative Integer Hack Drained $9M From XPR

I have seen input validation bugs blow up protocols, but the speed here is nauseating. An attacker drained $9 million from XPR Network in just 11 minutes by exploiting a negative amount flaw. This incident proves that basic arithmetic checks are still the weakest link in layer-1 security. The core thesis is simple: if you can pass a negative integer to a withdrawal function, you own the protocol's liquidity.

• The exploit used negative values to manipulate internal balances before withdrawing real assets.

• Total stolen value reached $9M, including 1.56 billion XPR and various stablecoins.

• The attack touched 6.5% of XPR's circulating supply, spiking crypto prices volatility.

• Producers patched the contract, preventing further drainage, but trust is broken.

• This differs from complex flash loan attacks; this was pure logic failure.

The Mechanics of the Negative Amount Bug

The vulnerability was in the withdrawal function of proton.swaps. The code accepted negative amounts, allowing the attacker to create a negative balance in the pool. By manipulating these internal states across multiple pools like XUSDC and METAL, the attacker effectively printed value. This is a classic integer underflow issue that should have been caught in any basic audit. It highlights how small code gaps can amplify losses across interconnected liquidity pools.

Market Reaction and Crypto News Impact

The on-chain drain immediately hit the order books. XPR price dropped from $0.00276 to $0.00242, a 6.5% decline in hours. The RSI fell to 27.47, signaling deep oversold territory. While buyers stepped in to push it back to $0.00259, the token remains below key support at $0.00271. This pattern is typical for DeFi exploits: a sharp dump followed by a weak rebound as investors wait for clearer signals. For broader context, check our Crypto News Today feed for how this fits into the wider crypto market news narrative.

On-chain data shows 563 million XPR moved through the LOAN protocol after the attacker borrowed against stolen stablecoins. This secondary movement increased the total XPR touched to 2.12 billion. The attacker later moved 764 million XPR and 150,000 METAL to a separate account. These transaction details are public and serve as a blueprint for how quickly liquidity can be skimmed when validation is weak. If you are tracking these movements, our [DeFi Intelligence](https://www.yourweb3guy.com