# "smart contract" (exploit OR hacked OR drained) — X 热门讨论 (2026-09-15 21:31 UTC)
## @BruceXPR (Bruce Stewart) · 09-15 19:27 · ♥23 ↻10 💬1 🚨 XPR NETWORK UPDATE — EXPLOIT PATCHED & RECOVERY MOVING FORWARD ⚛️
A major update from Paul Grey / ProtonNZ on the proton.swaps incident.
The vulnerability that allowed negative withdrawals was patched on September 12. A subsequent review of 117,530 historical withdrawals found only three accounts had ever attempted negative withdrawals—the failed June probe and the two September exploiters.
The recovery numbers are substantial:
⚛️ ~1.856 BILLION XPR recovered — ~87% 💵 100% of the stolen stablecoins recovered 🔩 12.87M METAL recovered 🏦 Remaining LP deficit funded through the XPR Consortium 🔐 Recovered assets staged for restoration of the liquidity pools 🛠️ Broader network improvements are progressing through review, testing and audit.
Perhaps most impressive was the response itself: 20 block-producer accounts participated across the recovery multisigs, demonstrating how decentralized governance can coordinate during a real-world emergency.
This incident exposed a serious smart-contract vulnerability. It also gave XPR Network a real-world stress test—and resulted in fixes, recovery, deeper infrastructure review and lessons that can make the network stronger.
The bug was found. The exploit was stopped. Most assets were recovered. The pools are being made whole. And the infrastructure is being hardened. ⚛️
Credit to Paul Grey and the XPR Network block producers for documenting the incident transparently and doing the work. https://t.co/nqWVxs4x6J @MetallicusTDBN @XPRNetwork #XPRNetwork #XPR #Metallicus #METAL #Blockchain #DeFi #CryptoSecurity https://x.com/BruceXPR/status/2099943189562191951