X100 Exploit Nets 4.85 Million USDT After Governance Takeover

X100’s case sits in the part of crypto security where control of governance can matter as much as code. Flash loans and on-chain voting systems have become familiar tools and targets in DeFi, and X100 is now another example of a project whose administrative layer was compromised rather than a single contract function. Blockaid’s alert and the reporting around it place the incident on Ethereum and tie it to governance, which is the part of a protocol that decides how treasury and system changes are handled.

For users, builders, and token holders around X100, the immediate consequence is that treasury-linked assets and liquidity positions were turned into USDT and the attack was still unfolding when it was flagged. That means the usual assumptions about who can authorize moves inside a protocol no longer held during the incident, and any remediation would have to focus on governance access, not just code patches. Projects that rely on decentralized voting now face another reminder that control over the voting path can be as sensitive as custody itself.

The larger tension is between decentralization and the ability to secure a protocol’s decision-making process. A system that gives voting power to on-chain participants can also expose that power to borrowed influence, and the X100 incident shows how quickly treasury controls can be redirected when that layer is captured. The trade-off is especially stark in DeFi, where the same mechanisms meant to distribute control can also become the route into the treasury.

Still unknown is how much of the USDT movement was ultimately retained and whether X100 has fully contained the governance compromise. Blockaid’s alert shows the attack was active at the time, but the follow-up steps, recovery path, and any governance changes are not laid out here. The details that would settle the picture are whether X100 restored voting control, identified the route into governance, and confirmed the final asset movements.

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.