A new blockchain investigation has linked a wallet involved in the $4.85 million X100 governance exploit to an earlier attack against Limit Break’s Payment Processor, while tracing approximately $96,382 in stolen USDT through cryptocurrency exchange services.
Blockchain intelligence platform PublicAML disclosed the connection on October 25, identifying an Ethereum wallet previously associated with the September 29 Limit Break incident as the address behind a second exploitation of X100’s governance vulnerability.
The wallet, 0xfc3fAcD67138966aB0c841E905B0C4BCA1AbE92F, allegedly extracted 96,381.88 USDT after the initial attacker had already drained approximately $4.75 million from X100 on October 24. Researchers traced the proceeds through an ETH conversion, with approximately 40.9 ETH subsequently reaching an address labeled as a ChangeNOW deposit.
Investigators also identified funding connections involving FixedFloat shortly before the original exploit and confirmed that the first attacker’s proceeds, converted into 2,022.86 ETH, remained distributed across five Ethereum addresses as of October 25.
The October 25 findings do not represent a new exploit. All identified extraction transactions occurred on October 24. The latest development is the additional forensic evidence connecting previously identified wallets and tracing how the stolen assets moved.
Second X100 attacker wallet previously appeared in Limit Break investigation
According to PublicAML’s October 25 investigation, the wallet responsible for X100’s second extraction was not newly created for the attack.
PublicAML had identified the same address in its September 29 investigation into the Limit Break Payment Processor V2 drain, where the wallet reportedly extracted 10.6 WETH from addresses that had granted token approvals.
The earlier incident involved NFT trading infrastructure used by multiple marketplaces. Dave Finances previously examined the Limit Break Payment Processor security incident, including a white-hat operation that moved 3,832 NFTs to protect them from potential exploitation.
PublicAML’s newly identified wallet connection suggests that an address previously involved in exploiting NFT trading permissions also participated in an unrelated governance vulnerability affecting an Ethereum-based token project.
However, identifying the same blockchain address across incidents does not establish the real-world identity of its controller or prove that the original X100 attacker and the Limit Break attacker were the same individual.
The second X100 transaction occurred around 14:36 UTC on October 24, roughly 24 minutes after the first extraction. The wallet borrowed approximately 1.95 million USDT through Morpho, purchased X tokens and used two helper contracts to obtain majority control of X100’s three-seat governing Senate.
It then manipulated the protocol’s treasury and liquidity positions, ultimately retaining approximately 96,382 USDT and additional X tokens.
Stolen funds traced to ChangeNOW after conversion into ETH
PublicAML reconstructed the second wallet’s movements after the exploit, identifying a sequence that converted the extracted stablecoins into approximately 40.9 ETH through the OKX decentralized exchange router.
At approximately 14:45 UTC, 10 ETH moved to one intermediary address. Another 30.9 ETH was sent to a separate address three minutes later.
Both intermediaries subsequently forwarded their balances to Ethereum address 0x3f3Ee0a9cAC2d01DB44001eca3E8382fbe40207B, which researchers and Etherscan identify as a ChangeNOW deposit address.
The transfers reached the labeled destination by approximately 14:57 UTC, within about 20 minutes of the initial extraction.
PublicAML also found that the wallet had received transaction-fee funding through the same ChangeNOW-labeled address on October 23, creating another connection between the suspected attacker and the exchange service.
The tracing establishes a reported movement of assets into an exchange-associated address. It does not independently establish whether the funds were converted into another asset, withdrawn to a particular destination or ultimately recovered.
Neither the ChangeNOW attribution nor the use of the OKX DEX router establishes wrongdoing by either service.
FixedFloat funding appeared minutes before the $4.75 million drain
A separate finding concerns the funding of the original X100 attacker.
PublicAML identified two ETH transfers, totaling approximately 0.861 ETH, arriving from an address attributed to FixedFloat at 14:05 and 14:06 UTC on October 24.
The primary exploit transaction followed at approximately 14:11 UTC.
The investigation found no earlier funding transactions involving that attacker wallet. The timing suggests that the transferred ETH provided the gas required to execute the attack, although it does not identify who initiated the transfers or supplied the underlying assets.
Independent analysis from Bitquery confirmed the mechanics of the original governance exploit. The attacker borrowed approximately 1.94 million USDT through Aave, acquired enough X tokens to seize two of three Senate seats and immediately approved a treasury transaction.
The malicious proposal caused X100’s treasury to exchange 400,000 X tokens for approximately 35.68 USDT through a liquidity pool created by the attacker. The attacker subsequently sold part of the acquired tokens through the project’s existing Uniswap liquidity and repaid the flash loan.
The operation generated approximately 4,749,726 USDT in proceeds, later converted into 2,022.86 ETH.
PublicAML’s October 25 snapshot showed 400 ETH in each of four receiving wallets and another 422.86 ETH in a fifth address, collectively worth approximately $4.77 million. None of those balances had moved as of 18:00 UTC.
A third extraction on October 24 also removed roughly 549,915 X tokens and a smaller quantity of USDT. Those tokens should not be valued at their pre-attack price when estimating realized losses, particularly after X’s reported decline of more than 96%.
Why the Limit Break connection matters for DeFi security
The most interesting part of the investigation is not the additional $96,382 in stolen funds. It is the possibility that a wallet previously associated with one DeFi exploit was able to take advantage of another vulnerability less than a month later.
That connection highlights a recurring weakness in decentralized finance: attackers do not necessarily need to compromise private keys or break complex cryptography. They can exploit the assumptions embedded in smart-contract permissions and governance rules.
In X100’s case, control of the treasury depended on holding two of three Senate seats. The contract allowed those seats to change according to temporarily locked token balances, while proposals could be created, approved and executed within a single Ethereum transaction.
A flash loan turned that design into an opportunity. The attacker needed significant capital only for the duration of the transaction, not a long-term economic commitment to the protocol.
The problem resembles the wider risks exposed by Neutron’s earlier governance attack, although the technical mechanisms and recovery responses were different.
Governance systems are often presented as safeguards because they distribute authority among multiple token holders. But decentralization provides limited protection if temporary voting power can be purchased and immediately used to execute unrestricted transactions.
The vulnerability becomes especially dangerous when governance controls liquidity or treasury assets rather than simply setting longer-term protocol policy.
Repeated exploitation exposes the cost of slow incident response
The X100 attack also shows how quickly an exposed vulnerability can attract additional participants.
After the first wallet extracted approximately $4.75 million, a second wallet used similar governance mechanics to secure another $96,382. A third wallet subsequently exploited the system to acquire additional X tokens.
This resembles the pattern seen in the UNCX exploit involving copycat attackers, where the estimated damage expanded after additional wallets and automated traders exploited the same vulnerable infrastructure.
For smaller protocols, the consequences can be devastating. A project may lack the security monitoring, emergency controls or development resources needed to contain an attack before others reproduce it.
In X100’s case, the governance architecture allowed multiple wallets to manipulate treasury operations within roughly half an hour. The immediate financial damage was accompanied by a collapse in trading liquidity, leaving remaining token holders exposed to extreme price volatility and substantial execution risk.
Even if stolen assets are eventually recovered, rebuilding confidence can be harder than repairing the contract.
Can investigators turn the newly identified exchange links into recoveries?
The FixedFloat and ChangeNOW connections introduce potential investigative leads, but they should not be mistaken for evidence that the services knowingly facilitated the attacks.
Exchange-related transaction records may help investigators reconstruct funding sources and subsequent asset movements, depending on what information the services retain and whether it is available to investigators.
That is a different problem from directly recovering funds.
The original attacker’s approximately 2,022.86 ETH remained visible in five wallets at the October 25 snapshot, making subsequent movements relatively straightforward to monitor. However, ETH held in an externally controlled wallet cannot ordinarily be frozen merely because blockchain researchers identify its address.
The second attacker’s funds present another challenge because the traced ETH reached an exchange-labeled deposit address, after which the available public investigation does not establish a complete final destination.
Similar tracing difficulties emerged in an earlier investigation of stolen cryptocurrency moving through multiple services and blockchains, where identifying the flow did not by itself establish who ultimately controlled the assets.
For X100 investors, the next meaningful developments would include verified information about asset recovery, the status of the compromised governance contracts, and whether the team can restore safe trading liquidity.
The October 25 investigation has narrowed some of the unanswered questions by connecting an attacker-associated wallet to a previous incident and documenting previously unidentified money flows. But it has not identified the individuals behind the attacks or established that the stolen funds can be returned.
The larger lesson is that on-chain transparency can make the aftermath of an exploit easier to reconstruct without necessarily preventing the exploit itself. For DeFi projects, the most important security controls must operate before a transaction can seize governance authority and drain a treasury, not only after investigators begin following the money.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574