Attacker Drains 4.85 Million USDT From X100 After Seizing Governance Control
X100 Loss Reaches 4.85 Million USDT
Attackers successfully extracted approximately 4.85 million USDT from the X100 protocol on Ethereum. The exploit took place on October 24, 2026, and utilized the project's internal governance system to move funds. The total amount stolen across two specific transactions was calculated at 4,846,107.98 USDT by The Defiant.
The attack involved seizing control of the project's treasury. The attackers used this control to sell held tokens and convert liquidity positions into stablecoins. USDT is a cryptocurrency designed to hold a value of one US dollar.
Flash Loans Enabled Quick Senate Takeover
- The first attack used a flash loan, a temporary borrowing of crypto assets, from the Aave platform.
- The loan amounted to roughly 1.94 million USDT.
- Attackers used these funds to buy X tokens and register two new contracts in the project's Senate.
- With a majority in the three-member Senate, the attackers approved a sale of 400,000 X tokens.
- The second transaction used a similar method to withdraw liquidity from five existing pool positions.
Transaction Details and Treasury Status
The initial transaction occurred at 10:11 a.m. ET. It resulted in 4.75 million USDT being routed to the attacker's address. The second transaction happened at 10:35 a.m. ET, yielding an additional 96,381.88 USDT along with about 9,895 X tokens. Both transactions occurred within less than 25 minutes.
The X100 token page lists a maximum supply of 14 million X tokens. The primary treasury contract, known as the Freezer, still holds approximately 12.17 million X tokens as of the report. This figure represents the token balance, not the available cash value.
Attack Continues as Containment Unknown
Security firm Blockaid issued an alert stating that the attack was still ongoing at 10:49 a.m. ET. There is no independent confirmation that the exploit has stopped or that the remaining liquidity has been secured. The Uniswap pool used for the cash-out contained only about 199.55 USDT at the time of viewing, indicating significant depletion of trading liquidity.
Source
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.
Related Posts
Anchorage Digital Bank Adds Custody for Etherlink Assets and Tokenized Uranium
Bitwise CIO Matt Hougan says crypto's bull run may not need the Clarity Act
