Third X100 Exploit Transaction Drains 550,000 Tokens From Uniswap Pool

Third X100 exploit drains nearly all remaining Uniswap liquidity

Security firm Blockaid reported on October 24 that a third exploit transaction removed roughly 550,000 X tokens from the X100 Uniswap V3 X-USDT pool. Uniswap is a decentralized exchange where users trade crypto assets directly using liquidity pools instead of a central company managing the trades.

The transaction confirmed at 10:40 a.m. ET routed 549,915.55 X and 1,909.36 USDT to a new beneficiary wallet. This payout was heavily weighted toward the X token rather than the stablecoin, which is a digital asset pegged to the U.S. dollar. After the withdrawal, the affected pool held less than 200 USDT, leaving very little stablecoin available for holders to sell their X tokens through that specific venue.

This third extraction extends the ongoing governance attack on the X100 token. Blockaid stated at 11:10 a.m. ET that the attack was still ongoing.

Key numbers from the latest transaction

• The third transaction moved 549,915.55 X and 1,909.36 USDT to a beneficiary.
• The affected Uniswap pool had only 197.55 USDT and 193.37 X left after the transaction.
• The beneficiary wallet held about 549,111 X at the time of reporting.
• The transaction involved a 300 USDT loan and repayment on the Aave lending protocol.

How the exploit reused existing contracts

The third transaction used the same two Senate-member contracts that were involved in the second exploit. X100 offers staking rewards to users who lock up, or freeze, their tokens. The project’s Senate governance system is responsible for approving treasury operations.

Execution logs showed two votes in favor within a three-member Senate for the liquidity withdrawal and subsequent treasury swaps. The process burned a specific non-fungible token (NFT) representing a Uniswap position and collected the assets into a designated Freezer contract. The Freezer contract still held about 12.17 million X at the time of checking, which is a token balance rather than USDT that holders could cash out.

What is confirmed

• A third exploit transaction occurred on October 24.
• The transaction removed approximately 550,000 X from the Uniswap V3 X-USDT pool.
• The beneficiary address is different from the previous two transactions.
• The pool liquidity was nearly depleted of USDT after the withdrawal.

What is still unclear

It is not confirmed that the operators of the new wallets are unrelated to the previous exploit transactions. The source material notes that different wallets alone do not prove that the people behind them are different. It remains unclear whether more transactions will occur, as Blockaid indicated the attack was ongoing.

Why it matters for holders

For X100 holders trying to sell their tokens, the depletion of the specific Uniswap pool means there is very little stablecoin available to exit through that venue. While the Freezer contract holds a significant amount of X tokens, this does not automatically provide liquidity for holders to cash out. The ongoing nature of the attack creates uncertainty for anyone holding the asset.

Sources

• The Defiant

Read also: X100 Exploit Proceeds Split Into Four Ethereum Wallets

Read also: Uniswap adds seven trading sources while 0x disputes protection against malicious hooks