XPR Network: WebAuth bug caused 35 LOAN liquidations; separate ~$169K escrow drain
17 Oct 2026: XPR block producer MadBlocks describes two incidents. A bug in the WebAuth signing contract put debt on 67 LOAN accounts and caused 35 liquidations before a patch; bridged USDC returned to LOAN. 9M XPR (~$169K) sent to KuCoin.
All 16 LOAN markets paused; Metallicus CEO says funds are secured. No security-firm confirmation and no SlowMist row at our check. Research snapshot from MadBlocks and Marshall Hayner.
369 take
Two different rails, one day: wallet-signing bug vs third-party escrow. Sized by a block producer, not a security firm. Metal Pay and LOAN pauses are normal pain until unwind completes.
Check official Metallicus / Metal Pay status before moving funds.
Sources