Nyxus Protocol

[Time Capsules on the XPR network @TimeCap_XPR]

@tobinalan Yall need to play nice and kiss and make up.

Too much stuff to be built and only 10% of people are building.

Snap out of it. Stop being gorilla marketing and build your baby !

Its just that simple. Try save your state too. Cause yall about to be rich. In a war zone. Wake up

[Nyxus Protocol @NyxusProtocol]

@Talocan1500 @tobinalan @Sniplingxpr @GettrFatterTony @lilreom How do you think Paul is making the real money? DEX looks too quiet to be earning a lot in fees

[WenXCodius 🇨🇳🇨🇮🇧🇷🇮🇷🇷🇺 @mewnDate]

@GettrFatterTony 3 types of XPR community posts

1. The Simpson decodorrrr
2. The Ai slop generatorrr
3. The Indirect, passive aggressive, public attackorrr

What’s missing ?

[Nyxus Protocol @NyxusProtocol]

@DaumItMawn @echodatruth @Stas31777 @beardedmone If you KYC your account you can bridge USDC into MetalX and buy XPR there. MetalX is the official XPR Network DEX.

[Nyxus Protocol @NyxusProtocol]

Another major piece of Nyxus Protocol is now in place.

Browser support is complete.

[Nyxus Protocol @NyxusProtocol]

@LPagani808 @GettrFatterTony You mean the guy buying up all the new tokens and dumping them?

[Alvosec ⚛️ @alvosec]

⚠️ Beware of spoofed “exchange” accounts. Do not send any funds to these accounts. Scammers are creating / buying lookalike accounts and using them to deceive users into sending funds to fraudulent addresses.

Only trust verified exchanges listed on #WebAuth Wallet.

[Nyxus Protocol @NyxusProtocol]

Development on Nyxus Protocol continues

Here’s a WIP in-game render of the galaxy
Currently 100,000 star sectors
1M+ planets to conquer, develop & harvest

[protonnz ⚛️ @protonnz]

🚨 XPR NETWORK WALLET DRAINER — full infrastructure teardown of "xprdrop . com"

Following up on my mitigation post. Here's the machine behind the "XPRDROP airdrop" scam draining XPR Network wallets — the accounts, the backend API, the cloaking, and the money flow. Everything below is on-chain or observable.

The accounts (4 on-chain):
• xprdrops — deploys the fake "XPRDROP" lure token
• symbiote — drainer/controller (wave 1)
• xprgrant — drainer/controller (wave 2)
• rasmr5 — cash-out staging
All created 26–30 Jul, days before the spray.

It was rehearsed. Before any real victim, the attacker ran the full grant→drain flow TWICE on their own test accounts (justingates→symbiote, rasmr5→xprgrant), recycling the same ~8,935 XPR. Then deployed the lure and went live. Premeditated.

Delivery = the token memo itself. Wallets render it as the tx description, so the phishing link lands straight in your wallet UI via a token you never requested. ~2,900+ wallets sprayed, still running. The lure copy is even A/B tested ("up to $10k" is winning).

The frontend cloaks itself. It's a Vite SPA titled "XPR Network — Community Rewards." Before it even loads, it calls its backend to decide if YOU should see it. Flagged IPs / researchers get bounced to google .com and permanently marked (xpr_v_blk=1). That's why analysts see a blank page.

The backend — api . xprdrop . com/api/analytics — is an Express server with 5 endpoints:
• GET /check — cloaking gate
• POST /visit — landing telemetry
• POST /wallet — your full portfolio
• POST /claim — outcome
• GET /w — backup beacon

/wallet is the nasty one: on connect it exfils your account, XPR (liquid + staked + unstaking), up to 30 token holdings, and eligibility. Connecting ALONE leaks your entire portfolio — before you sign anything.

The drain payload is built per-victim. It ranks your holdings against a 39-token priority list (XBTC, XETH, stables first), links up to 20 token contracts to the malicious "claim" permission, and deliberately SKIPS locked.token (can't be moved). Whoever built this knows Antelope.

Real-time relay. The API replies {"ok":true,"sent":true} — it forwards each profile to the operator instantly (bot/webhook). That's why the drain lands ~15 seconds after you sign: they're pinged the moment you connect, and sweep immediately.

It persists — and re-drains. Because it's a permission, not a transfer, it has an "extend" mode: revisit and it skips the grant, just links your NEW tokens. One wallet got drained a SECOND time for ~1.5M XPR after topping up. Delete the permission or it never stops.

Infra: xprdrop . com + api → 80.78.18.13, hosted on Njalla (privacy shield), AS39287 Materialism s.r.l., Malmö SE. Registrar Tucows, registrant Nevis (redacted). Domain registered 30 Jul 2026 — hours before the lure token went live.

Money flow: stolen tokens → swapped to XPR on Alcor / proton.swaps → consolidated in xprgrant → forwarded to rasmr5 → deposited to HitBTC (hitbtcxprins, memo 7773400473558716). Only ~200K XPR has left the chain. **~2.35M XPR is still sitting in the attacker accounts.**

Possible prior: shares an off-ramp + near-identical ~1.5M XPR pattern with an April drain (acct "yougothacked" → same HitBTC deposit account). Could be the same actor — but no key overlap, so unconfirmed. Exchange KYC could settle it.

— IOCs —
Domains: xprdrop .com / api .xprdrop.com → 80.78.18.13 (Njalla, AS39287)
Accounts: xprgrant · symbiote · xprdrops · rasmr5 · justingates (test)
Keys: xprgrant EOS8EYZXNVFLeFNKLqegtBVKyqFq78Mbo7rwrsQfyc4VB6XhBhDtS · symbiote EOS73WoPhPHppr7vT5NFXJgUa75h2efiT8dvzb6WDWRWwcpGPxnsS
Grant: permission "claim" → xprgrant@active (or symbiote@active)
Cash-out: rasmr5 → hitbtcxprins, memo 7773400473558716

Never sign airdrop "claims." 🙏 RT to spread.

[Nyxus Protocol @NyxusProtocol]

Completed an update that hardened the Nyxus Protocol internal economy from external token price fluctuations.

A persistent on-chain world cannot let market volatility distort the internal cost of building, producing, and expanding.

Core simulation costs now use resource-based accounting and market-aware reference values to keep the economy coherent.

Technical update:
https://t.co/5X8f578mHD

The result is a more resilient simulation economy.

[Nyxus Protocol @NyxusProtocol]

Nyxus Protocol is being designed with a low barrier to entry.

The client app will be open source and free to download.

There are no fees to join and start exploring.

Transactions require no gas fees. Zero.

Enter the world. Establish a position. Begin expanding.

[Nyxus Protocol @NyxusProtocol]

Procedural planet in alpha testing stage.

This sample of a barren world is taken from the client app, still in development.

These planets are not just scenery. They are productive positions inside a persistent on-chain world.

[Nyxus Protocol @NyxusProtocol]

@SimpleDEXFun @RaulCena3 Unfortunately, 10k wasn’t enough to stop creators from rugging for pennies. Have you explored a vesting unlock period for creator investment on the curve? Something where launch investment unlocks gradually over time for the creator after graduation?

[Nyxus Protocol @NyxusProtocol]

The Nyxus Protocol website is now live:
https://t.co/nXzaPE5Ftv

It is still early and a WIP, but the project now has a public home.

More updates will follow.

Built on @MetalBlockchain

[Nyxus Protocol @NyxusProtocol]

Nyxus Protocol is designed around emergent roles.

There is no single path participants must follow.

Resources need to move. Territory requires management. Routes need protection. Empires must be organized. Exposed positions create opportunity.

Roles emerge from how people choose to participate.

[Nyxus Protocol @NyxusProtocol]

Nyxus Protocol was created from a simple idea: a token ecosystem should offer more than passive exposure.

Participants should have a direct way to increase their position through the protocol itself.

Nyxus turns that premise into a persistent on-chain world where people pursue finite, yield-producing positions.

Design model:
Asset -> Opportunity -> Competition -> Conquest

The world does not live in a private server; it will exist as a L1 blockchain on @MetalBlockchain, where protocol governance enforces the rules of the simulation.

[Nyxus Protocol @NyxusProtocol]

Nyxus Protocol is a decentralized conquest simulation built on @MetalBlockchain.

Expand, conquer, defend, and compete to control resources in a persistent on-chain world.

Outcomes are earned through strategic planning, coordination, and initiative.

More details coming soon.