X100, an Ethereum-based DeFi project, was drained through a governance attack on Oct. 24 after attackers used flash-loaned funds to seize two of the protocol’s three treasury-controlling Senate seats. The first two attacks extracted an estimated 4.85 million USDT in less than 30 minutes, exploiting rules that allowed newly acquired voting power to become active immediately and let approved proposals execute without a delay.
The incident turned a governance mechanism intended to reward long-term token locking into a route for temporary, borrowed capital to control the treasury. Attackers did not need to compromise private keys or exploit a conventional smart-contract coding flaw; they used the protocol’s stated voting and execution rules to direct treasury assets into pools they controlled.
Two Senate seats gave attackers treasury control
X100’s treasury was governed by a three-seat body known as the Senate. Holding two seats was sufficient to approve proposals, including proposals that could move treasury assets.
To qualify for a Senate position, an address had to deposit X tokens into a “Freezer” contract for one, three, or five years and pay a 100 X fee. The three addresses with the largest currently frozen balances held the seats.
That structure created two critical weaknesses. A single party could compete for multiple seats by using multiple wallets or smart contracts, and the protocol did not impose a waiting period between freezing tokens and receiving governance authority. Once a proposal passed, it could execute immediately.
Before the attack, the second-ranked Freezer address held roughly 19,000 X. At 22:11 on Oct. 24, the first attacker borrowed approximately 1.94 million USDT through an Aave flash loan, a form of uncollateralized borrowing that must be repaid within the same blockchain transaction.
The attacker used the borrowed USDT to buy X, then distributed tokens between two helper contracts. Each contract froze 19,000.000001 X — only one-millionth of a token more than the previous second-place balance.
That tiny margin was enough to take the second and third Senate seats simultaneously. With two seats secured, the attacker could approve treasury proposals without support from the remaining senator.
Treasury tokens were sold into an attacker-made pool
The attacker’s first proposal instructed the treasury to sell 400,000 X into an X/USDT liquidity pool on PancakeSwap V3. The pool had been created by the attacker in the same transaction and was funded with only about $100 in liquidity.
GoPlus analysis said the proposal system allowed a proposal to designate a trading pool while failing to enforce an effective minimum amount of tokens that the treasury needed to receive. The attacker set the minimum USDT output to zero.
As a result, the treasury transferred 400,000 X into the thinly funded pool and received only about $35.68 in USDT. Because the minimum-output setting was zero, the transaction did not revert despite the negligible proceeds.
The attacker then withdrew liquidity from the self-created pool, recovering X tokens, and sold part of those tokens through an existing Uniswap V3 X/USDT pool. After repaying the Aave flash loan and transaction costs, the first operation produced an estimated profit of about 4.75 million USDT.
Every stage of that sequence — borrowing, buying tokens, freezing them, capturing Senate seats, approving the proposal, moving treasury assets, selling tokens, and repaying the loan — occurred in one transaction. That compressed timeline gave other token holders no practical opportunity to respond on-chain.
Follow-on attackers reused the same weaknesses
A second attacker repeated the seat-capture method roughly 24 minutes after the first exploit. Using another flash loan, that wallet obtained enough X to take Senate control, removed part of a Uniswap V3 liquidity position associated with the Freezer, and routed assets through another attacker-created pool.
The second operation generated approximately 96,400 USDT, according to the transaction analysis described in the supplied materials.
About five minutes later, a third wallet took advantage of an auxiliary contract deployed during the second attack. The contract reportedly lacked a caller restriction, allowing another party to reuse the governance control path. The third wallet passed a proposal transferring roughly 550,000 X.
The first two attacks accounted for the estimated 4.85 million USDT loss. The third transaction moved additional X tokens, adding another layer of damage after the initial treasury drain.
Bitquery tracking showed the first attacker converted most USDT proceeds into ETH within minutes and divided the funds among five wallets holding a combined 2,022.86 ETH. The second attacker also swapped USDT for ETH, then sent funds through an intermediary wallet to ChangeNOW.
The attack exposed a design problem beyond token concentration
The X100 exploit did not depend solely on a low token threshold. Its mechanics combined several permissions that magnified one another: rankings based on current token balances, no restriction on one entity holding several seats, instant activation of governance power, immediate proposal execution, and a treasury trading function without a meaningful minimum-return protection.
A timelock would have separated seat acquisition from treasury control, giving the community and automated monitoring systems time to inspect the proposal. Vote snapshots — which measure voting power at a fixed earlier block rather than at the moment of voting — could also reduce the usefulness of flash-loaned tokens.
The protocol’s Senate model also illustrates why wallet-based representation can be misleading. Three top-ranked addresses may appear to represent separate participants, but smart contracts and newly created wallets can allow one operator to occupy multiple positions unless the design limits linked control or requires longer-held voting power.
Recent attacks have targeted governance thresholds
X100 joins a series of governance-related incidents in which attackers acquired enough voting power to approve malicious actions or gain control over protocol funds.
In July, Bonk DAO suffered an attack estimated at about $20.50 million after an attacker reportedly spent roughly $4.09 million to acquire 1.003% of the token supply, just above the approval threshold. The attacker then used the voting process to move assets and later withdrew staked tokens after voting ended.
Term Finance has also been associated with losses of about $8.50 million, while Arkadiko was attacked on Oct. 22 after an attacker acquired enough DIKO to approve a proposal that introduced a malicious contract. The Arkadiko incident was estimated to have caused losses of around $1.09 million, with no opposing votes recorded.
Other incidents were stopped before funds were removed. In March, an attacker spent about $1,808 acquiring MFAM and self-delegating tokens before submitting a Moonwell proposal tied to control over seven lending markets and core contracts involving around $1.08 million in user funds. In September, an Olas attacker reportedly locked 5,100 OLAS, valued at about $135, to exceed the proposal threshold.
For DeFi users, X100 places particular focus on governance systems where temporary token ownership can immediately unlock execution rights over a treasury. Protocols that combine concentrated voting power with no activation delay leave little room for token holders, developers, or security monitors to stop an approved malicious transaction before assets move.
Worried about DeFi governance risks? Learn core DeFi security basics before locking funds in experimental protocols.
Disclaimer: The content on this page is provided for general informational purposes only and does not represent the views or financial advice of Toobit. We make no guarantees regarding the accuracy or completeness of this information and shall not be held liable for any errors, omissions, or outcomes resulting from its use. Investing in digital assets involves risk; users should independently evaluate their financial situation and the risks involved. For further details, please consult our Terms of Service and Risk Disclosure.
