X100, an Ethereum-based token project, lost control of its on-chain governance on October 24, 2026, after attackers bought their way into two of its three “Senate” seats and used that majority to drain treasury tokens and liquidity. The attackers have realized roughly $4.85 million in Tether (USDT) so far, and blockchain security firm Blockaid says the attack is still in progress.
Show
How the X100 Exploit Unfolded
Blockaid flagged the attack on X, reporting that one attacker seized two of the three Senate seats and sold 400,000 X tokens from the project treasury into a liquidity pool the attacker had created. A second attacker then burned the Uniswap V3 liquidity position held by X100’s Freezer contract. Uniswap V3 is a version of the Uniswap decentralized exchange (DEX) in which each liquidity position is recorded as a non-fungible token (NFT).
The Freezer contract is X100’s staking system. According to the X100 token page on Etherscan, holders “freeze” X for one, three, or five years to earn rewards in X. The same contract holds treasury assets and runs the Senate, the small group of top stakers that votes on treasury actions.
A Flash Loan Bought the Senate
The first exploit transaction, confirmed at 14:11:47 UTC, opened with a flash loan of 1,942,457.64 USDT from Aave, a decentralized finance (DeFi) lending protocol. A flash loan is an uncollateralized loan that must be borrowed and repaid within the same blockchain transaction.
The attacker used the borrowed USDT to buy 38,200 X from the Uniswap V3 X/USDT pool and split the tokens between two newly deployed helper contracts. Each helper froze 19,000 X and paid a 100 X registration fee, after which the Freezer registered and ranked both as Senate members. A proposal was then created, voted on by the two new senators, and executed inside the same transaction. The event log records two votes in favor from a three-member Senate, and the proposal’s on-chain description read “testnet flash governance proof.”
The approved proposal directed the Freezer to sell 400,000 X into a PancakeSwap V3 pool that the attacker had created moments earlier in the same transaction. The treasury received just 35.68 USDT for those tokens. The attacker then pulled liquidity from that pool, recovering 399,986.8 X, and sold 131,702.92 X into the Uniswap V3 X/USDT pool for about 6.69 million USDT.
After repaying Aave, the attacker’s contract sent 4,749,726.10 USDT to the attacker’s address and kept roughly 268,284 X.
Third Attacker Pulls Remaining Liquidity
Blockaid later reported that a third attacker followed the same Senate route. A transaction at 14:40:47 UTC, sent from address 0xDAB1…F8c8, shows two newly seated Senate members passing a series of proposals that removed 549,999.4 X and 30.69 USDT from the Freezer’s Uniswap V3 position and burned the position NFT. About 549,916 X from that withdrawal ended up at an address controlled by the attacker.
Across three transactions, the attackers have collected about $4.85 million in USDT and around 550,000 X, while roughly 12.2 million X remained in the Freezer at the time of Blockaid’s latest update. Blockaid also listed address 0xfc3f…E92F among the exploiter addresses.
X Token Price Collapses
Etherscan market data showed X trading at $1.78 as of 17:38 UTC on October 24, a 96.52% decline. The ERC-20 token, a standard format for fungible tokens on Ethereum, has a maximum supply of 14 million X and 202 holders.
Why the Senate Design Failed
The transaction records point to a structural weakness rather than a coding bug in the token itself. Senate seats were awarded based on frozen balances at the moment of the call, so tokens bought seconds earlier carried full voting weight. Proposals could also be created, approved, and executed in a single transaction, leaving no window for existing holders or the team to react.
Protocols commonly guard against this pattern with voting-power snapshots taken before a proposal opens, minimum holding periods for voters, and timelocks that delay execution after a vote passes.
Governance takeovers have become a recurring theme in 2026. Term Finance lost about $8.5 million in a governance exploit on August 23, while cross-chain bridge attacks, led by the Kelp DAO breach in April, have driven the year’s largest losses.
Blockaid’s alerts and on-chain data remain the primary sources for tracking the X100 exploit. With about 12.2 million X still held in the Freezer and the same governance path apparently still open, losses could rise further.
Also Read: Initia Halts Blockchain After Researcher Reports $2.6 Million Exploit