X100 Exploit Nets 4.85 Million USDT After Governance Takeover
- Published
- Updated
- Since then
- 4 new reports
X100’s governance exploit was followed by transfers that moved project assets out of treasury and liquidity positions into USDT, with Blockaid saying the incident on Ethereum was still ongoing at the time of its alert. Later transactions showed the proceeds being converted and distributed across ether wallets, while one related pool was left with very little USDT. The movement of funds also reached Tornado Cash, and several holding wallets still retained a large ether balance.
Key claims & sources
What it means
X100 is a governance-driven project, so access to its on-chain voting system mattered more here than a single contract flaw. The incident unfolded on Ethereum and was first flagged by Blockaid, which said the attack was still active when it posted its warning. That places this case in the category of control-plane failures, where governance rights become the target instead of only a token contract.
For users and builders around X100, the practical effect is that project-controlled assets were pushed through a sequence of transfers, conversions and wallet movements rather than remaining in place. The Uniswap pool tied to the event was left with less than 200 USDT, and the later flow into ether wallets shows how quickly proceeds can be re-routed across addresses. Anyone integrating with a project that relies on on-chain governance has to account for the possibility that voting access can override normal treasury safeguards.
This episode underscores a tension in decentralized systems: governance that is meant to distribute control can also become the point where control is seized. The use of a flash loan in the takeover shows how borrowed capital can be used to momentarily overwhelm voting power, which is a familiar weakness in token-governed systems. The later move of funds toward Tornado Cash also highlights how quickly traces can be fragmented after an exploit. (per thedefiant.io)
Market reaction i
The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.
Coverage timeline
Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.
Thefts of a similar size
| When | What happened | Figure |
|---|---|---|
| 43 days ago | Duelbits · Private key leakage incident | $4.9M |
| 2.1 years ago | Shezmu · Access control incident | $4.9M |
| 8.4 years ago | Verge · 51% attack incident | $4.8M |
| 2.6 years ago | Super Sushi Samurai · Infinite Mint incident | $4.8M |
| 4.3 years ago | ZB Exchange · Hot Wallet Key Compromised incident | $4.8M |
4280 incidents stored · 505 were as large as this one or larger ($4.8M)