X100, an Ethereum-based DeFi project, lost approximately $4.85 million in USDT on October 24 after attackers used flash loans to seize control of its governance system and execute malicious proposals against the project's treasury and liquidity reserves.

By capturing two of the three seats on X100's governing Senate, the attackers were able to approve and execute transactions without waiting for any governance delay. The initial attack generated roughly $4.75 million in proceeds, and additional withdrawals lifted the total loss to $4.85 million.

Blockchain security firm Blockaid flagged the ongoing exploit at 14:49 UTC in an X post, identifying multiple malicious transactions targeting the protocol's Freezer contract. A subsequent update from the firm identified approximately 550,000 additional X tokens extracted from a Uniswap liquidity position, while roughly 12.2 million X remained in the Freezer.

Flash Loan Secures Senate Majority

The first attack began at 14:11 UTC, when a wallet borrowed approximately 1.94 million USDT through an Aave flash loan and used the funds to purchase 38,200 X tokens. The attacker split the tokens between two newly deployed contracts, each staking slightly more than 19,000 X in X100's Freezer system. Those deposits displaced existing Senate members and handed the attacker control of two of the governance body's three seats.

With the required majority secured, the attacker submitted and immediately executed a proposal directing the treasury to sell 400,000 X into a newly created PancakeSwap V3 liquidity pool. Because the manipulated pool held only a small amount of USDT, the attacker acquired the treasury tokens for approximately 35.68 USDT before withdrawing the liquidity.

The attacker then sold approximately 131,703 X through an existing Uniswap V3 pool, receiving roughly 6.69 million USDT. After repaying the flash loan, the transaction netted approximately $4.75 million.

The exploit was possible because X100's governance contracts allowed newly registered senators to vote on and execute proposals within the same blockchain transaction. Flash loans, which provide uncollateralized borrowing that must be repaid within a single transaction, gave the attacker the temporary capital needed to acquire voting power. The protocol lacked an effective waiting period between gaining governance authority and exercising control over treasury assets. Timelocks that defer a proposal's execution until a later block are a widely used safeguard in DeFi governance precisely because they give token holders time to react — and to exit — before treasury-moving transactions take effect. The X100 incident shows how, in token-weighted governance systems, the voting mechanism itself can become the attack surface even when a protocol's token and treasury contracts are not directly exploited.

Proceeds Converted Into Ether

The initial proceeds were rapidly exchanged for approximately 2,022 ETH through UniswapX, with the resulting cryptocurrency transferred to another Ethereum wallet. That address subsequently distributed 1,600 ETH across four newly created wallets, each receiving 400 ETH, while approximately 423 ETH remained at the consolidation address during the initial transaction analysis.

Additional governance attacks followed the first withdrawal. At 14:35 UTC, a second transaction used a similar flash-loan strategy to capture Senate seats and remove Uniswap V3 liquidity positions controlled by the Freezer contract, generating approximately 96,382 USDT in additional proceeds. A third transaction at 14:40 UTC used the compromised governance pathway to withdraw another liquidity position containing approximately 550,000 X tokens. Those tokens were extracted separately from the $4.85 million USDT total.

The transactions originated from different sending wallets, and investigators have not established whether they were controlled by separate attackers or coordinated by a single party.

Token Plunges as Vulnerability Remains Exposed

X100's token suffered a sharp decline following the attack, with trading data, as reflected on CoinGecko, indicating a drop exceeding 96% as liquidity disappeared from its principal trading pool. The quoted percentage should be treated cautiously, because the remaining liquidity was extremely thin, making the displayed token price an unreliable measure of realizable market value.

The attack is the latest in a series of recent flash-loan-driven governance exploits. In August, an attacker obtained sufficient governance authority over Term Finance to execute malicious proposals and drain approximately $8.5 million from Ethereum-based lending vaults. A separate flash-loan attack on Shibarium in September 5 also involved the temporary acquisition of governance-related tokens, although that incident targeted validator authority and bridge assets rather than the immediate execution of treasury proposals. Across these incidents, authority over protocol assets was tied to tokens that could be acquired within a single transaction, leaving quorum and approval thresholds as the last line of defense.

In X100's case, the Senate's two-thirds approval requirement offered little protection, because voting authority could be acquired and exercised immediately using borrowed capital.

During the initial hours after the exploit, the project had not published a public incident report or confirmed a recovery plan, and Blockaid continued to warn of active exposure after identifying the third transaction. Approximately 12.2 million X remained in the Freezer contract at the time of the firm's October 24 assessment. No confirmed recovery of the withdrawn funds, contract remediation, or compensation arrangement had been disclosed. Whether the tokens still held in the Freezer contract are moved next, and whether the project follows up with a post-mortem or governance changes, remained the primary open questions after Blockaid's October 24 assessment.