X100 Exploit Proceeds Split Into Four Ethereum Wallets
Attacker converts exploit funds to Ethereum
The exploiter behind the X100 governance attack converted approximately 4.75 million USDT (a stablecoin) into Ether (ETH) on October 24. Chainalysis and Ethereum transaction records show these funds were subsequently distributed to four separate wallets, with each receiving 400 ETH.
The distribution occurred between 10:39 a.m. and 10:43 a.m. ET. As of 3:36 p.m. ET, these four recipients still held a combined total of roughly 1,600 ETH. The central wallet responsible for distributing the funds retained an additional 422.86 ETH.
Key figures in the breach
- Total stablecoins converted: Approximately 4.75 million USDT.
- ETH sent to each wallet: 400 ETH (total 1,600 ETH).
- Remaining ETH in distributor wallet: 422.86 ETH.
- Additional exploit proceeds: A third transaction paid out roughly 550,000 X tokens and 1,909 USDT to a different beneficiary.
How the funds moved
The initial exploit payout address exchanged 2 million USDT for 851.54 ETH and 2.75 million USDT for 1,170.47 ETH using the UniswapX protocol. These sums were aggregated and sent to a distribution wallet, which then split the assets into the four 400-ETH transfers. Blockchain trackers noted that none of the four recipient wallets showed outgoing transactions at the time of the report.
What remains unknown
While the primary stablecoin funds have been traced to the four wallets, the final destination of the remaining approximately 560,000 X tokens held at attacker addresses is not yet clear. Chainalysis reported it is continuing to monitor these funds. The second and third exploit transactions' beneficiaries still held significant amounts of X tokens, specifically around 9,895 and 548,799 X respectively.
Why this matters
This incident highlights the speed at which attackers can move and diversify stolen assets to obscure their trail. By quickly swapping stablecoins into Ether and splitting the holdings across multiple addresses, the exploiter complicates potential recovery efforts by law enforcement or the X100 team. The attack involved seizing governance seats to force the treasury to sell tokens into an attacker-created pool, demonstrating the risks associated with on-chain governance controls.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.