X100 governance exploit: flash loan seizes treasury in one transaction
An attacker borrowed about 1.94 million USDT, bought enough tokens to capture two of three seats on the protocol's ruling Senate and drained roughly $4.85 million before anyone could react.
The X100 governance exploit shows how fast on-chain democracy can be bought. On Saturday, Oct. 24, an attacker used flash loans to take control of the Ethereum-based DeFi project's governing Senate and pull about $4.85 million in USDT out of its treasury and liquidity pools, according to Crypto Adventure.
What happened
The attack began at 14:11 UTC. A wallet took a flash loan of about 1.94 million USDT from Aave and used it to buy 38,200 X tokens. It split them between two freshly deployed contracts, each of which locked just over 19,000 X in the protocol's Freezer contract. Those deposits pushed out existing members and handed the attacker two of the Senate's three seats.
With a majority in hand, the attacker submitted a proposal and executed it at once. It ordered the treasury to sell 400,000 X into a new PancakeSwap V3 pool holding almost no USDT, so the attacker could buy them for roughly 35.68 USDT. About 131,703 X were then sold through an existing Uniswap V3 pool for around 6.69 million USDT. After repaying the loan, the first transaction netted about $4.75 million; later withdrawals lifted the total to $4.85 million.
Security firm Blockaid flagged the exploit at 14:49 UTC, and a later update found about 550,000 more X pulled from a Uniswap liquidity position as the X100 governance exploit continued. The proceeds were swapped for about 2,022 ETH through UniswapX, and 1,600 ETH was then split evenly across four new wallets. Chainalysis also tracked the theft, and attacker addresses still held about 560,000 unsold X when it published, Coin Alert News said.
Why it matters
The flaw was a missing delay. X100's contracts let newly registered senators vote and execute proposals in the same transaction, so there was no window between acquiring voting power and spending the treasury. A flash loan, which must be repaid within one transaction, fits that gap perfectly. A timelock of even a few blocks would have broken the attack.
It is the second notable exploit in two days. Initia halted its chain on Oct. 23 after a MoveVM minting bug let an attacker bridge out about $2.7 million, and Coin Alert News put the combined losses at about $7.4 million. Governance and bridge logic keep showing up as weak points, a theme in Hacken's third-quarter loss report.
What's next
Attention now turns to the four 400 ETH wallets and whether the funds move through mixers or exchanges, where issuers and venues may be able to freeze them. X100 holders will also want to know what happens to the roughly 12.2 million X still sitting in the Freezer and whether governance can be patched before the next vote.
For other DAOs, the X100 governance exploit is a checklist item: snapshot voting power before proposals, add execution delays and cap what a single proposal can move. The full transaction breakdown is in Crypto Adventure's report.
This article is for information only and is not investment advice.