X100 loses about $4.85M in flash loan governance attack

Key points

• Attacker took two of three X100 Senate seats on Oct. 24 using a ~1.94M USDT flash loan
• About $4.85M in USDT was extracted, per Blockaid via Bitcoin.com News
• Governance had no stake-age rule, snapshots or execution delay, per CryptoSlate
• X token reportedly fell more than 96%; no official X100 statement as of Oct. 24

An attacker took control of the governance system of X 100 Global, an Ethereum-based project, on Oct. 24 and extracted about $4.85 million in USDT, according to Bitcoin.com News, which cited security firm Blockaid. The attack relied on a flash loan of roughly 1.94 million USDT that was borrowed and repaid within a single transaction, per CryptoSlate.

How the flash loan governance attack worked

X100 is governed by a three-seat Senate. CryptoSlate reported that the attacker froze X tokens in two helper contracts, each locking 19,000.000001 X under the project’s one-year lock, and so qualified for two seats. Senate eligibility depended on the amount currently frozen, with no minimum stake age, the outlet said.

With two of three seats, the attacker approved a treasury swap in the same transaction. That swap sent 400,000 X from the project’s treasury, known as the Freezer, into a liquidity pool the attacker had created. The Freezer received only 35.675313 USDT in return, according to CryptoSlate. The attacker then sold the tokens and repaid the loan from the proceeds.

Bitcoin.com News said the loan came from Aave and that the governance system had no voting snapshots, minimum holding periods or execution delays. As a result, the attacker could approve and execute proposals almost immediately. It said security firm Exvul explained the root cause.

Losses and market impact

Reported totals vary by tally. Bitcoin.com News put proceeds at about $4.85 million in USDT, plus roughly 550,000 X tokens extracted across three transactions, including later operations against Uniswap V3 liquidity positions. CryptoSlate said about 4.75 million USDT reached the first final recipient after the loan was repaid, and that ChainBounty contributor Philippark reconciled 4.848 million USDT paid to three recipients, excluding unsold X tokens.

Bitcoin.com News reported that, in Blockaid’s latest cited update, about 12.2 million X tokens remained in the Freezer while the incident was still unfolding. It also reported that the X token fell from the $50 to $60 range to about $1.75, a drop of more than 96%, and that some decentralized exchange liquidity readings fell to a few dollars. As of the afternoon of Oct. 24, the outlet said, X 100 Global had not issued an official statement or acknowledged the breach on its social media channels.

Why the design mattered

CryptoSlate argued that the one-year lock imposed a cost on the attacker but did not delay when the attacker gained authority, and that there was no compulsory waiting period before execution. The outlet said stake-age requirements, snapshot-based voting power or an execution delay could have blocked this type of attack.

CryptoSlate paired the X100 case with a separate governance exploit at Arkadiko, a lending protocol on the Stacks network. There, a proposal executed on Oct. 22 used a contract that lacked caller authorization, and Bitquery estimated the loss at about $1.09 million. The outlet said Arkadiko disabled the contract, paused governance, redemptions and liquidations, and restored the legitimate contract through a later proposal on Oct. 27.

What to watch next

The incident was described as ongoing in the latest available reports, and the project had not publicly responded at the time of those reports. Any recovery effort, compensation plan or changes to the Senate’s rules would come from X100 itself.