Ethereum-based cryptocurrency project X100 suffered a governance exploit on October 24, with attackers extracting approximately $4.85 million in USDT and withdrawing hundreds of thousands of additional X tokens from the project’s liquidity infrastructure.
Blockchain security firm Blockaid reported that attackers gained control of two of the project’s three Senate governance seats, allowing them to authorize treasury transactions and manipulate liquidity positions. The firm said the attack remained ongoing in its latest confirmed update.
The reported $4.85 million represents USDT proceeds already realized by the attackers, not the total value of assets affected. A subsequent transaction removed approximately 550,000 X tokens, while millions more remained in the project’s Freezer contract, leaving the final financial damage uncertain.
Attackers Seized Control of X100’s Three-Seat Senate
The attack exploited X100’s unusual governance architecture, which places significant control over treasury assets and liquidity management in the hands of a three-member Senate.
Under the system, proposals require support from two of the three Senate members. That voting threshold became the central weakness when attackers acquired enough influence to control a majority of the seats.
Transaction analysis indicates that the initial attacker used a flash loan of approximately 1.94 million USDT from decentralized lending protocol Aave to acquire X tokens and establish two new Senate positions.
The attacker reportedly purchased approximately 38,200 X tokens, distributing them between two newly created contracts. Each contract then committed tokens to the project’s Freezer mechanism, enabling them to qualify for Senate membership.
With two seats under their control, the attacker could approve and execute governance proposals without the support of the remaining legitimate Senate member.
The first malicious proposal directed the treasury to sell 400,000 X tokens into a newly created liquidity pool controlled by the attacker. According to transaction analysis, the treasury received only approximately 35.68 USDT from that operation.
The attacker subsequently recovered the tokens from the manipulated pool and sold part of the balance through existing Uniswap V3 liquidity, converting the extracted value into USDT.
The operation illustrates how a governance system can be compromised without necessarily breaking the underlying token contract. The attacker instead used the protocol’s own authorization process to approve transactions that benefited the attacker.
Third Attacker Removes Another 550,000 X Tokens
Blockaid initially identified two exploit transactions that collectively generated approximately $4.85 million in USDT proceeds.
In its first public alert at 14:49 UTC on October 24, the security firm reported that a second attacker had burned Uniswap V3 liquidity positions held by X100’s Freezer contract.
Approximately 21 minutes later, Blockaid disclosed another development: a third attacker had used the same Senate governance mechanism to withdraw additional liquidity.
The third transaction removed approximately 550,000 X tokens from the remaining affected Uniswap V3 liquidity position. Blockchain records place that transaction at approximately 14:40 UTC, before Blockaid’s first public warning.
In its updated security alert, Blockaid reported approximately $4.85 million in realized USDT proceeds plus 550,000 X tokens extracted across three transactions.
The firm also estimated that approximately 12.2 million X tokens remained in the Freezer contract when it published the update.
These figures should not be combined into a single dollar-denominated loss estimate. The additional X tokens had not necessarily been converted into stablecoins, and their realizable value depends on available market liquidity.
X Token Plunges as Liquidity Disappears
The governance exploit triggered severe disruption in X token trading, with market data indicating a decline exceeding 96% during October 24.
Reported prices fell from approximately $50–$60 before the incident to around $1.75–$1.80 after liquidity was removed. However, those quotations require caution because depleted liquidity can produce prices that are not executable for meaningful transaction sizes.
X100 had promoted a fixed supply of 14 million X tokens, with treasury assets and liquidity decisions governed through its Senate structure.
The concentration of those responsibilities made the governance takeover particularly damaging. Once the attackers controlled the required voting majority, they could direct assets held within the project’s contracts.
No verified recovery announcement or confirmation that the vulnerable governance mechanism had been disabled was established in the reporting reviewed for this article. The final loss therefore remains unknown.
Why X100’s Governance Model Became Its Biggest Weakness
The uncomfortable lesson from X100 is that decentralization does not automatically translate into security.
A system can distribute decision-making authority among token holders and still leave its treasury effectively controlled by a very small number of participants. In X100’s case, two Senate seats were enough to exercise decisive authority over substantial assets.
What makes this incident particularly troubling is the speed with which that authority appears to have been acquired and exercised.
The reported attack sequence suggests that newly acquired tokens could immediately qualify contracts for governance participation. Those contracts could then approve proposals and execute treasury actions within the same transaction.
That leaves virtually no opportunity for ordinary holders to identify suspicious activity before funds move.
Governance systems generally need safeguards that separate the acquisition of voting power from the execution of sensitive decisions. Historical voting snapshots, minimum participation periods, proposal delays and restrictions on treasury transfers can help reduce the threat.
This is not the first example of governance authority becoming an attack vector. The September governance attack involving Neutron ultimately required extraordinary intervention by Cosmos Hub validators to recover more than 1.22 million ATOM.
The circumstances were different, but both incidents highlight an important distinction: a smart contract can execute its programmed instructions correctly while the governance process authorizing those instructions is compromised.
What the Exploit Means for X Holders and DeFi Investors
For X holders, the immediate concern extends beyond the $4.85 million already converted into USDT.
The approximately 550,000 additional X tokens extracted during the third transaction represent potential selling pressure. If those tokens reach exchanges or decentralized liquidity pools, they could deepen price volatility, particularly if available liquidity remains thin.
Meanwhile, the approximately 12.2 million X reportedly remaining in the Freezer should not automatically be considered lost. Their security depends on whether attackers can continue accessing the relevant governance functions and whether the project can restrict further unauthorized activity.
There is also a difference between token balances and recoverable economic value. A large treasury balance offers little immediate protection to investors if the governance mechanism controlling it remains vulnerable or its market liquidity disappears.
Previous incidents have demonstrated how rapidly liquidity problems can spread. Following the Kelp DAO exploit, a liquidity crunch at Aave illustrated how disruption in one part of decentralized finance can affect users of otherwise separate protocols.
X100’s situation is smaller and structurally different, but the underlying risk deserves attention: assets can remain visible on-chain while their practical accessibility or market value deteriorates sharply.
Investors should also resist treating the initial security alert as the complete incident report. In the earlier Garden Finance security incident, subsequent disclosures materially changed the understanding of which infrastructure had been compromised and whose funds were affected.
For X100, the next meaningful developments would be confirmation that the Senate attack path has been closed, an independently reconciled accounting of the affected treasury and liquidity positions, and a credible recovery or remediation plan.
Until those details emerge, the most important number is not necessarily the $4.85 million already extracted. It is the amount of economic value that may remain exposed to the same governance weakness.
The broader warning for DeFi investors is straightforward: governance arrangements deserve the same scrutiny as smart-contract code, especially when a small voting majority can immediately move millions of dollars in protocol assets.
Johan Shamshad is a financial markets writer at Dave Finances covering cryptocurrencies, trading platforms, brokers, fintech, financial regulation, and developments across global markets. He previously worked at Gulf News, adding newsroom experience to his coverage of fast-moving financial and digital-asset markets.
His work focuses on identifying market-moving events, company developments, regulatory changes, product launches, and shifts in trading and financial infrastructure.
Johan contributes news and analysis designed to help readers understand not only what happened, but why a development matters and how it may affect the wider financial landscape. You can reach out to him via his social media accounts:
Linkedin: https://www.linkedin.com/in/johan-shamshad-742851262/
X: https://x.com/Yasmine_FX
Investing: https://www.investing.com/members/contributors/279781574