X100 Protocol Loses $4.75M in Governance Attack

The X100 protocol lost about $4.75M in stablecoins on Oct. 24 at 10:11 AM ET, when an attacker took a majority of its governing body (the "Senate") and forced the treasury to sell its own X tokens at a near-zero price. ForKlog reported the loss, and the attack transaction is visible on Etherscan.

Details

According to Panda Security's breakdown, the whole attack fit into one Ethereum transaction. The attacker flash-borrowed 1.94M USDT, bought roughly 38,200 X and used two helper contracts to freeze 19,000 X in each, which captured two of the three Senate seats. A proposal was then proposed, voted and executed in the same transaction, making the treasury sell 400,000 X into a pool the attacker controlled. Tether's USDT is only the asset the funds were held in.

The same analysis traces the flaw to three design choices: anyone can join the Senate instantly for 100 X, seats go to the largest frozen balances at that moment, and proposals can be executed in the same transaction with no timelock. Blockaid put the total at about $4.85M once follow-on transactions were counted.

The attacker swapped the proceeds to ETH and spread it across four wallets holding 400 ETH each, keeping about 560,000 unsold X tokens (Cryptonomist, ForKlog). We found no statement from the X100 team at the time of writing.

What it means for the market

This is a textbook governance attack: voting power can be rented for a single transaction when a protocol does not snapshot balances or put a delay between a vote and its execution. For X holders the damage may not be over, since the tokens still held by the attacker weigh on the price.

For live BTC prices and the wider market, see the daily brief. This is not investment advice.

Full timeline — in our explainer.