hack or exploit

X100 Exploit Nets 4.85 Million USDT After Governance Takeover

0Importance
closedStatus
2News media
5Pieces
Published
Updated
Since then
4 new reports
Also mentions
ETHUSDTUNI

X100’s governance exploit was followed by transfers that moved project assets out of treasury and liquidity positions into USDT, with Blockaid saying the incident on Ethereum was still ongoing at the time of its alert. Later transactions showed the proceeds being converted and distributed across ether wallets, while one related pool was left with very little USDT. The movement of funds also reached Tornado Cash, and several holding wallets still retained a large ether balance.

Key claims & sources

✓
Two transactions moved X100 treasury tokens and liquidity positions into USDT.
✓
A later transfer sent about 549,916 X and 1,909 USDT from a different sender to a new beneficiary, while the affected Uniswap pool held less than 200 USDT.
✓
Blockaid said on X that X100 was under an Ethereum attack that was still in progress when it posted the alert.

What it means

X100 is a governance-driven project, so access to its on-chain voting system mattered more here than a single contract flaw. The incident unfolded on Ethereum and was first flagged by Blockaid, which said the attack was still active when it posted its warning. That places this case in the category of control-plane failures, where governance rights become the target instead of only a token contract.

For users and builders around X100, the practical effect is that project-controlled assets were pushed through a sequence of transfers, conversions and wallet movements rather than remaining in place. The Uniswap pool tied to the event was left with less than 200 USDT, and the later flow into ether wallets shows how quickly proceeds can be re-routed across addresses. Anyone integrating with a project that relies on on-chain governance has to account for the possibility that voting access can override normal treasury safeguards.

This episode underscores a tension in decentralized systems: governance that is meant to distribute control can also become the point where control is seized. The use of a flash loan in the takeover shows how borrowed capital can be used to momentarily overwhelm voting power, which is a familiar weakness in token-governed systems. The later move of funds toward Tornado Cash also highlights how quickly traces can be fragmented after an exploit. (per thedefiant.io)

Market reaction i

EthereumETH the event is about this asset
first headline
-0.8% 2 h before
-0.8% 4 h after
$2,349price at publication
12data points

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.

Coverage timeline

Every piece in order, with the time its news medium declares — if it is not believable we use ours and say so — and what it added to what was already known at that point. Arriving first is not the same as adding something.

first
Oct 24 14:58
+20 min
Oct 24 15:17
The Defiant context
Its angle: transaction, beneficiary, different
+4 h 43 m
Oct 24 19:41
The Defiant adds
Brings into the story: ETH
+1 d 23 h
Oct 26 13:58
The Defiant context
Its angle: distributor, deposits, emptied
+1 d 23 h
Oct 26 14:02
The Cryptocurrency Post adds
Adds $4.8M, with quotes

Thefts of a similar size

WhenWhat happenedFigure
43 days ago Duelbits · Private key leakage incident $4.9M
2.1 years ago Shezmu · Access control incident $4.9M
8.4 years ago Verge · 51% attack incident $4.8M
2.6 years ago Super Sushi Samurai · Infinite Mint incident $4.8M
4.3 years ago ZB Exchange · Hot Wallet Key Compromised incident $4.8M

4280 incidents stored · 505 were as large as this one or larger ($4.8M)