X100 Protocol Hit by $4.7M Exploit as Hackers Hijack Governance and Drain Treasury
Share
Key Takeaways
X100 suffered a governance exploit on Oct. 24, when attackers seized two of the three Senate seats using flash loans.
The attackers extracted approximately $4.85 million in stablecoins, with subsequent transactions bringing reported losses to roughly $4.85 million.
Stolen funds were converted into Ethereum, while hundreds of thousands of X tokens remained in attacker-controlled wallets.The
Ethereum-based decentralized finance protocol X100 has suffered a multimillion-dollar exploit after attackers manipulated its governance system to seize control of its treasury assets.
The Oct. 24 attack initially generated approximately $4.75 million in proceeds, with additional transactions increasing reported stablecoin losses to roughly $4.85 million.
HOW TODAY's X100 ATTACK WENT DOWN: Attackers deployed contracts that captured protocol Senate seats, gained voting majority, and forced the Freezer treasury to dump into an attacker-controlled pool. Approximately $4.7M in stablecoins were extracted across three exploit… pic.twitter.com/7JLff0q9cD
Unlike conventional cryptocurrency hacks that involve stolen private keys, this incident exploited the protocol’s decision-making structure.
Attackers temporarily acquired sufficient voting power to approve transactions that redirected treasury assets into liquidity pools they controlled.
Blockchain security investigators identified three exploit transactions, raising concerns about how quickly governance authority could be acquired and exercised without additional safeguards.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
The attack began at approximately 14:11 UTC, when an attacker borrowed approximately 1.94 million USDT via an Aave flash loan.
Flash loans allow users to borrow cryptocurrency without posting collateral, provided the borrowed amount is repaid within the same blockchain transaction. The attacker used the funds to acquire approximately 38,200 X tokens, then distributed them between two newly deployed smart contracts.
Each contract staked slightly more than 19,000 X tokens into X100’s Freezer system, securing two of the protocol’s three Senate seats.
That majority was sufficient to approve a malicious governance proposal.
The attacker then instructed the Freezer treasury to sell 400,000 X tokens into a specially created PancakeSwap liquidity pool.
Because the pool contained very little USDT, the transaction allowed the attacker to acquire the treasury’s tokens for approximately 35.68 USDT.
The acquired tokens were subsequently sold through another liquidity pool, generating roughly 6.69 million USDT before repayment of the flash loan. After settling the borrowed funds, the attacker retained approximately $4.75 million.
Stolen Funds Converted Into 2,022 ETH Across Five Wallets
Following the initial exploit, the attacker converted approximately 4.75 million USDT into 2,022.86 ETH through UniswapX.
The funds were subsequently distributed across five Ethereum addresses. Four wallets received 400 ETH each, while a fifth retained approximately 422.86 ETH.
According to an Oct. 25 investigation by the blockchain analytics firm Bitquery, ETH remained unchanged at the time of its analysis.
However, the initial attack was not the end of the incident.
Approximately 24 minutes later, another wallet exploited the same governance weakness, extracting an additional 96,382 USDT.
A third transaction removed approximately 550,000 X tokens from the protocol’s liquidity positions.
Bitquery’s transaction-level analysis calculated total stablecoin losses of 4,846,108 USDT across two transactions, while the third primarily involved X tokens. This provides a more precise breakdown than initial reports of $4.7 million across three transactions.
The first attack came 47 minutes after the last big transfer into the treasury. | Source: bitquery.io
X100 Hack Exposes a Bigger DeFi Governance Problem
The vulnerability was not simply that attackers accumulated voting power. X100 allowed newly appointed Senate members to approve and execute proposals immediately, without a mandatory waiting period.
That design enabled attackers to borrow capital, seize governance authority, manipulate treasury transactions, and repay their loans within a single blockchain transaction.
Bitquery also found that the attacker-controlled proposal permitted a minimum sale price of zero, leaving the treasury exposed to transactions at extremely unfavorable prices. The incident highlights the limitations of governance systems that rely exclusively on token holdings without additional protections.
Voting snapshots, execution delays, and restrictions on treasury transactions can make similar attacks more difficult, although no single measure eliminates governance risk.
X100’s token reportedly lost more than 96% of its value as liquidity disappeared, making quoted market prices increasingly unreliable.
As of Bitquery’s Oct. 25 assessment, approximately 12.17 million X remained in the Freezer contract, while two Senate seats were still controlled by contracts associated with a subsequent attacker.
No confirmed recovery plan or compensation arrangement had been established in the reviewed investigations.
The X100 exploit demonstrates how a protocol’s governance rules can become an attack surface even when its smart contracts execute exactly as programmed.
Disclaimer:
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Dr. Guneet Kaur is a senior editor at CCN.com and a Science Fellow at Exponential Science. She is a fintech and blockchain expert with extensive experience in digital finance education, blockchain ecosystems, and cryptocurrency markets. She has worked with global media such as Cointelegraph, as well as education and blockchain platforms, to design and lead strategic content and learning initiatives. As an educator and assessor for top-tier executive programs, she bridges real-world fintech trends with academic insight.
Dr. Kaur is also a published researcher and peer reviewer across fintech and data science journals, including Financial Innovation Journal and International Journal of Big Data Intelligence and Applications. Her work spans data-driven analysis, Web3 innovation, and technical content development. With a strong foundation in both industry and academia, she translates complex financial technologies into practical applications, empowering learners, professionals, and institutions across the rapidly evolving digital finance landscape.
