X100 Loses $4.85 Million as Flash-Loan Attack Hijacks Governance

Ethereum-based DeFi project X100 lost approximately $4.85 million in USDT on October 24 after attackers used flash loans to seize control of its governance system and execute malicious proposals against the project’s treasury and liquidity reserves.

The attackers gained two of three seats in X100’s governing Senate, enabling them to approve and execute transactions without waiting for a governance delay. The initial attack generated approximately $4.75 million in proceeds, followed by additional withdrawals that brought the total to $4.85 million.

Blockchain security firm Blockaid flagged the ongoing exploit at 14:49 UTC, identifying multiple malicious transactions targeting the protocol’s Freezer contract. A subsequent update identified approximately 550,000 additional X tokens extracted from a Uniswap liquidity position, while roughly 12.2 million X remained in the Freezer.

Flash Loan Gave Attackers Control of X100’s Senate

The first attack began at 14:11 UTC when a wallet borrowed approximately 1.94 million USDT through an Aave flash loan and used the funds to acquire 38,200 X tokens.

The attacker distributed the tokens between two newly deployed contracts, each staking slightly more than 19,000 X in X100’s Freezer system. Those deposits displaced existing Senate members and gave the attacker control of two of the governance body’s three seats.

With the required majority secured, the attacker submitted and immediately executed a proposal directing the treasury to sell 400,000 X into a newly created PancakeSwap V3 liquidity pool.

The manipulated pool contained only a small amount of USDT, allowing the attacker to acquire the treasury tokens for approximately 35.68 USDT before withdrawing the liquidity.

The attacker then sold approximately 131,703 X through an existing Uniswap V3 pool, receiving roughly 6.69 million USDT. After repaying the flash loan, the transaction generated approximately $4.75 million in net proceeds.

The exploit was possible because X100’s governance contracts allowed newly registered senators to vote and execute proposals within the same blockchain transaction. The protocol lacked an effective waiting period between acquiring governance authority and exercising control over treasury assets.

Attackers Convert Stolen USDT Into 2,022 ETH

The initial proceeds were rapidly exchanged for approximately 2,022 ETH through UniswapX, with the resulting cryptocurrency transferred to another Ethereum wallet.

That address subsequently distributed 1,600 ETH across four newly created wallets, each receiving 400 ETH. Approximately 423 ETH remained at the consolidation address during the initial transaction analysis.

Additional governance attacks followed the first withdrawal.

At 14:35 UTC, another transaction used a similar flash-loan strategy to capture Senate seats and remove Uniswap V3 liquidity positions controlled by the Freezer contract. That operation generated approximately 96,382 USDT in additional proceeds.

A third transaction at 14:40 UTC used the compromised governance pathway to withdraw another liquidity position containing approximately 550,000 X tokens. Those tokens were extracted separately from the $4.85 million USDT total.

The transactions came from different sending wallets, although investigators have not established whether they were controlled by separate attackers or coordinated by the same party.

X Token Plunges as Governance Vulnerability Remains Exposed

X100’s token suffered a sharp decline following the attack, with trading data indicating a drop exceeding 96% as liquidity disappeared from its principal trading pool.

The quoted percentage should be treated cautiously because the remaining liquidity was extremely thin, making the displayed token price an unreliable measure of realizable market value.

The incident follows an earlier Term Finance governance exploit in August, when an attacker obtained sufficient governance authority to execute malicious proposals and drain approximately $8.5 million from Ethereum-based lending vaults.

A separate Shibarium flash-loan attack in September 2025 also involved the temporary acquisition of governance-related tokens, although that incident targeted validator authority and bridge assets rather than immediate execution of treasury proposals.

In X100’s case, the Senate’s two-thirds approval requirement offered little protection because voting authority could be acquired and exercised immediately using borrowed capital.

The project had not published a public incident report or confirmed a recovery plan during the initial hours following the exploit. Blockaid continued warning of active exposure after identifying the third transaction.

Approximately 12.2 million X remained in the Freezer contract at the time of its October 24 assessment. No confirmed recovery of the withdrawn funds, contract remediation or compensation arrangement had been disclosed.

The post X100 Loses $4.85 Million as Flash-Loan Attack Hijacks Governance appeared first on Crypto Adventure.