A crypto project created a three-seat governing body to protect its treasury. On October 24, 2026, an unknown wallet reportedly used a flash loan to take two seats, approve a near-worthless trade and walk away with millions of dollars in stablecoins. The deciding margin was just 0.000001 X.
The X100 exploit was more than a stolen-key incident. The transactions described in a detailed Bitquery forensic report published October 25 show an attacker using the protocol’s published voting and trading rules to redirect its treasury’s tokens. Two USDT-draining transactions extracted approximately 4.846 million USDT from X100’s trading liquidity. A third wallet later removed a large amount of X tokens.
A BlockBriefing review of the incident report, public transaction references and the project’s governance structure points to four related failures: voting power was measured at the moment of execution; borrowed funds could secure a majority immediately; treasury proposals could choose their own trading pool; and trades could proceed with a minimum return of zero.
Reporting note: The figures and wallet attribution below are drawn from Bitquery’s published on-chain reconstruction, corroborating security reports and linked Ethereum transaction records. BlockBriefing has not independently re-executed the entire transaction trace or identified the people behind the wallets. Later balances and governance positions may have changed since the October 25 checks.
A Senate majority bought with a temporary loan
X100’s governing body was called the Senate. Three wallets with the largest amounts of frozen X tokens held its seats. Two votes were enough to approve an action involving the project’s Freezer treasury contract.
That arrangement gave large token holders influence, but it did not distinguish long-term ownership from temporary voting power. There was no reported delay between securing a seat, passing a proposal and executing it.
According to Bitquery, the first attacker borrowed nearly $2 million in USDT from the Aave lending system through a flash loan, bought X and locked the tokens through two newly created helper contracts. Each helper held 0.000001 X more than the incumbent stake it needed to defeat. The two contracts took the second and third Senate seats.
The extra millionth of a token was not the amount used to finance the attack. It was merely the winning margin over the existing Senate members. The actual purchase and locked stake required much more capital, made temporarily available through the loan.
This distinction explains the failure: the attacker did not need to persuade real token holders or wait for an election. It needed enough temporary stake to occupy two seats when the governance contract checked the rankings.
Why 400,000 X were exchanged for just $35.68
Once the attacker-controlled contracts held two votes, one proposed a treasury swap and the other approved it. The proposal could execute in the same Ethereum transaction.
The Freezer contract permitted the proposal to identify a trading pool and specify the minimum acceptable output. Bitquery found that the attacker had created the selected PancakeSwap pool shortly beforehand and supplied it with only a small amount of liquidity.
The proposed minimum output was zero. The Freezer then sent 400,000 X tokens into that pool, receiving only $35.68 in USDT, according to Bitquery’s reconstruction. The nominal price at which X last traded would have valued that many tokens at roughly $20 million. That paper valuation was not a realistic amount that could have been realized from such a thin market.
This was the decisive transfer of value. The proposal did not directly send $4.85 million in USDT out of the Freezer. Instead, it made the treasury hand over X tokens at an extreme discount. The attacker recovered tokens from its controlled pool and sold some into the separate, real X/USDT market on Uniswap, taking the available stablecoin liquidity.
The principal transaction is listed on Etherscan. The treasury involved is the X100 Freezer contract.
Who supplied the millions drained from the market?
One of the most revealing findings is where the available USDT came from. Bitquery reported that members of X100’s own Senate accounted for approximately 99% of the USDT added to the trading pool between 11:00 UTC and the first exploit.
One Senate-linked wallet made a final large X purchase just two minutes before the first attack. The pool’s USDT holdings had reached roughly $4.75 million. Soon after, the attacker sold into it and collected most of those stablecoins.
The sequence exposes a difference often missed in headlines about token values: market capitalization is not the same as exit liquidity. Bitquery estimated that, at the last quoted price before the exploit, all X tokens were notionally worth about $712 million. Yet the single trading pool behind that price held less than $5 million in USDT.
A large token balance can therefore appear valuable on paper while being impossible to sell anywhere near that valuation. The exploit used that gap, and the protocol’s permission to trade treasury assets at essentially any price, against the people who had just funded the market.
Three wallets acted within about half an hour
The first USDT extraction occurred at 14:11:47 UTC on October 24. Bitquery calculated that the attacker retained approximately 4,749,726 USDT after its transaction sequence.
At 14:35:59 UTC, another wallet used a similar flash-loan strategy, this time involving Morpho, to take the Senate seats and withdraw additional assets. Bitquery put the second wallet’s USDT proceeds at 96,382 USDT, alongside X tokens.
About five minutes later, a third wallet used callable helper contracts left by the second attacker to move approximately 549,916 X from remaining liquidity arrangements, plus around $1,909 in USDT. A copy-trading bot then attempted a similar action and obtained much less.
There is no demonstrated basis to say all these wallets belonged to the same person. The public blockchain shows transactions and contract interactions, not the identities or relationships of the operators.
The roughly $4.85 million headline figure concerns the first two major USDT extractions. Adding the third wallet’s X-token amount at the pre-attack market price would inflate the apparent loss, because the market was largely depleted by then.
Where the proceeds went
Bitquery traced the first wallet’s stablecoins into ETH through UniswapX. The resulting 2,022.86 ETH was split across five addresses: four holding approximately 400 ETH each and one holding the remaining 422.86 ETH.
The blockchain researchers said those balances had not moved at their October 25 checkpoint. That is a historical observation, not confirmation that the funds remain untouched now.
They reported that the second attacker converted its USDT into ETH and sent it through intermediary addresses to the ChangeNOW service within about half an hour. Services and liquidity providers named in the transaction path are not accused of participating in the theft merely because their infrastructure processed a transfer.
A separate PublicAML reconstruction broadly supports the figures for the first two attackers and the five-wallet ETH distribution. It also reports a possible relationship between one wallet and earlier malicious activity. That attribution is not treated here as proof of who controlled the wallet.
Could the attacker still control governance?
At its October 25, 04:19 UTC checkpoint, Bitquery reported that two of the three Senate seats remained held by helper contracts from the second exploit. The contracts accepted calls without restricting who could trigger them.
That presented a continuing governance concern at the time of the check. However, the researchers also reported limits on further damage. The treasury’s allowance for putting X into market pools had been nearly exhausted. The Freezer code reserved an amount equal to users’ frozen stakes, placing those stakes outside the assets the Senate could trade.
It would therefore be inaccurate to claim, without a newer on-chain check, that an attacker can still drain another $4.85 million or that users’ locked tokens were taken. The public evidence supports a serious control failure on October 24 and a specific residual exposure observed the next morning.
The security controls that were missing
For another example of a protocol’s permissions failing under attack, see our Mezo exploit investigation. The incidents had different technical causes but both raise questions about contract-level safeguards.
The X100 case illustrates a governance design in which several safeguards failed together:
- Voting snapshots: A snapshot taken before voting could have prevented newly acquired, temporary stake from immediately reshuffling Senate seats.
- Execution delay: A waiting period between proposal approval and execution could have given other stakeholders time to inspect a suspicious treasury trade.
- Trading safeguards: Verified pool destinations and meaningful minimum-return checks could have limited the treasury’s ability to exchange a large balance for almost nothing.
- Constrained authority: More restrictive treasury roles could have separated governance votes from direct execution of sensitive market operations.
These are analytical safeguards rather than proof that any one change would have stopped every possible attack. The actual outcome would depend on how the contracts were implemented and audited.
There is also a broader lesson. A governance system may be decentralized in the sense that anyone can compete for power, yet still be vulnerable if that power can be borrowed and used instantly. Public voting is no guarantee of secure voting.
What remains unanswered
The first missing piece is the X100 team’s explanation. The reporting reviewed for this investigation did not establish a confirmed, detailed public postmortem from the project’s operators.
Other outstanding questions include whether any emergency controls were activated after October 24, whether the open helper contracts have been disabled or replaced, whether treasury permissions were changed, and whether investigators have identified recoverable proceeds.
It is also unclear who operated the original Senate wallets that supplied most of the trading pool’s USDT. Their transactions can be traced, but those traces do not establish their real-world identities or motives.
The most important finding is already visible in the reported transaction history: the X100 attacker did not need to break the rules to seize power. The rules allowed control to change for a moment, and that moment was long enough.
How this investigation was prepared: BlockBriefing assessed Bitquery’s October 25 on-chain report, relevant Ethereum transaction and contract links, Blockaid-linked incident coverage, and PublicAML’s secondary fund-flow analysis. Numbers and wallet labels are attributed to those researchers rather than presented as new, independently completed blockchain forensics. This report does not identify the attacker or allege involvement by the named lending, exchange or routing services. This article is informational and not investment advice.
