X100 hack explained: how $4.75M was stolen

On Oct. 24 at 10:11 AM ET, an attacker took over the governance of the X100 protocol on Ethereum in a single transaction and walked away with about $4.75M in USDT. A flash loan bought two of the three seats on the project's governing "Senate", and the attacker used that majority to make the treasury sell 400,000 X tokens for roughly 36 USDT. Counting follow-on transactions, security firm Blockaid puts the loss at $4.85M. The X token fell 96% within a day.

What we know now

• The main attack was one transaction at 10:11:47 AM ET on Oct. 24, in block 26,263,022, netting about 4.75M USDT (Panda Security).
• Blockaid counts about 4.85M USDT drained in total. After the first attacker, two other actors hit the same weakness (Phemex, citing Blockaid; Panda Security).
• The proceeds were swapped to ETH and sit in four wallets holding 400 ETH each. The attackers still hold about 560,000 X they have not sold (Chainalysis, via Cryptonomist).
• As of 4:25 AM ET on Oct. 25, the main X/USDT pool on Uniswap was down 96.6% over 24 hours. X traded near $1.75, with about $340 of liquidity (DexScreener).
• At the time of publication we found no statement from the X100 team, no fund freezes and no bounty offer.

How it happened

X100 is an ERC-20 token (ticker X) on Ethereum. A three-seat "Senate" controls the project's liquidity. Members lock tokens in a contract called the Freezer, which also holds the treasury. Panda Security's analysis traces the exploit to three design choices that compound each other:

1. Anyone can join the Senate instantly by paying 100 X. There is no minimum holding period.
2. Seats go to whoever has the largest frozen balance right now. Balances are not snapshotted in advance, so voting power can be borrowed for a few seconds.
3. A proposal can be created, voted on and executed in the same transaction. There is no timelock, meaning no delay before a decision takes effect.

The attacker took a flash loan of about 1.94M USDT, which must be repaid within the same transaction, and bought roughly 38,200 X. Two freshly deployed helper contracts then froze a little over 19,000 X each, just enough to push out the sitting members and claim two of the three seats.

With a majority, the attacker passed and immediately executed a proposal. It made the treasury sell 400,000 X into a PancakeSwap V3 pool the attacker had just created and seeded with almost no USDT. The treasury's tokens went for about 35.68 USDT. About 131,700 X and roughly 6.69M USDT were then pulled from Uniswap V3 positions managed by the Freezer. After repaying the loan, about 4.75M USDT was left.

Timeline

Oct. 24, 10:11 AM ET. The main attack transaction is sent from 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63. The victim Freezer contract is 0x79f35a33fe2813414851c4ae8daeacd14d822a46 and the coordinating contract is 0x37541fc4a6f1ec86889ba506f51dc39f2bedd10a (Etherscan, Panda Security).

Oct. 24, 10:49 AM ET. Blockaid flags an ongoing attack on X100 and estimates losses at 4.85M USDT across two transactions. It says a second attacker destroyed the Freezer's Uniswap V3 liquidity positions, and it publishes the addresses and sample transactions (Phemex).

Oct. 24, later in the day. Panda Security publishes its technical breakdown. It says a third actor used the same Senate trick to extract about 550,000 X (Panda Security).

Oct. 24, by 5 PM ET. Chainalysis traces the funds: the stablecoins were swapped to ETH and split across four wallets holding 400 ETH each. About 560,000 X remain at the attackers' addresses (Cryptonomist, Coinfomania).

Oct. 25, 4:25 AM ET. The main X/USDT pool on Uniswap is down 96.6% over 24 hours, with X near $1.75 (DexScreener).

Where the money went

Chainalysis identified four wallets holding 400 ETH each (Cryptonomist). No transfers to mixers, bridges or exchanges have been reported so far. The estimates of unsold X differ by source. Chainalysis puts about 560,000 X at the attackers' addresses, while Panda Security counts about 268,000 X left in the attack contract.

What the team and exchanges did

We could not find an official statement from X100, and there is no word of frozen funds, talks with the attacker, a bounty or a post-mortem. No exchange has said it blocked any of the wallets. The alarm was raised by outside firms: Blockaid, Chainalysis and Panda Security.

What it means for holders

The money came out of the protocol's treasury and liquidity, not out of user wallets. Still, the token has almost no liquidity left: about $340 in the main pool, according to DexScreener. Any X sale now would face heavy slippage. Hundreds of thousands of X also remain with the attackers. Whether holders get any compensation depends on decisions the team has not yet announced.

The technique itself is well known. When a protocol neither snapshots balances in advance nor delays execution after a vote, voting power can be rented for a single transaction.

For another hack this week, see our Initia timeline. For ETH prices, see the Ethereum page.

This is not investment advice.

This story is developing: we are following events and adding new information as it emerges. Last updated Oct 25, 2026, 4:40 AM ET.