Digital Assets

Two contracts on @XPRNetwork were exploited on Saturday, ten hours apart. By Sunday morning the 1,143,288 USDC from the first one was back in @LOAN_Protocol, the attacker's remaining 7.21M ethereum:0xd7efb00d12c2c13131fd319336fdf952525da2af were locked, and the hole was patched. On most chains an exploit like this ends with the money bridged out and gone 👇 The attacker was software. The webauthn exploit made 67 accounts borrow on LOAN in a single transaction at 02:35:36 UTC and sent the USDC to the bridge 64 seconds later. Paul - protonnz said it plainly: the network is up against people with the most advanced AI there is. That is the threat model for every chain from now on, and code nobody has read in years is the cheapest thing to hit. Every layer did its part. The bridge never paid the USDC out, and at 05:08 it went back into LOAN. LOAN was paused at 03:12, 37 minutes after the first borrow, so nobody else could be dragged in. webauthn was patched at 03:46. When escrowhold, a third-party escrow, was drained at 12:24, its owner removed the contract's own permission at 13:45 so nothing else could leave. At 16:39, 19 block producers, madblocks among them, executed a multisig that replaced the attacker's keys and locked the 7.21M ethereum:0xd7efb00d12c2c13131fd319336fdf952525da2af still on his account. The only part that reached an exchange is the 85,887,410 ethereum:0xd7efb00d12c2c13131fd319336fdf952525da2af he sent to @kucoincom, and KuCoin has the memo. None of this needed a fork or a rollback. It works because accounts on XPR have names and permissions the chain understands, multisig is native, and the producers can act together within hours when something is plain theft. On most chains nobody can do that, and the money is gone before anyone wakes up. This morning the team went further. protonnz says the changes are in and the blue team is in control, and calls XPR the first chain with anti-hacker measures like these. The defense is being automated too: agents that test every contract the way an attacker would, around the clock. On XPR that costs no gas, so it can run on everything, third-party contracts included. That is what makes XPR and @MetalBlockchain stronger for what they are built for. A credit union on a Metal subnet needs a chain whose own governance can stop theft within hours decreasing to minutes, and that gets harder to attack every month. The first part already worked this weekend. If you build on XPR, when was your contract last tested?