In this article4 sections
Attackers reportedly took control of two of the three Senate seats governing X 100 Global on Oct. 24 and used that majority to drain the Ethereum-based project’s treasury, according to News.bitcoin. Security firm Blockaid traced approximately $4.85 million in USDT proceeds from the operation.
The project’s X token fell from the $50-60 range to approximately $1.75, a drop of more than 96%, while liquidity in decentralized trading pools largely disappeared. News.bitcoin reported that X 100 Global had not issued an official statement as of 3 p.m. EST on Oct. 24.
Also read: Visa Puts Stablecoin Pre-Funding Into Production With Inyo Global
Key facts
- Security firm Exvul said the attackers borrowed roughly 1.94 million USDT through an Aave flash loan to acquire voting power.
- Governance had no voting snapshots, minimum holding periods or execution delays, allowing proposals to be approved and executed almost immediately.
- One transaction moved 400,000 X tokens from the Freezer treasury into an attacker-controlled liquidity pool, returning about 36 USDT to the treasury.
- Blockaid identified approximately $4.85 million in USDT proceeds and roughly 550,000 X tokens extracted across three transactions.
- About 12.2 million X tokens reportedly remained in the Freezer at Blockaid’s latest cited update.
How the takeover worked
The attack targeted the project’s voting design rather than a coding flaw in a smart contract. Because the three-seat Senate could be entered by anyone holding enough tokens, and because votes and executions were not separated by time locks or holder snapshots, the attackers could buy their way in and act in the same sequence of transactions.
After taking the seats, the attackers’ proposals moved tokens out of the Freezer treasury. The transferred X tokens were then sold through a legitimate Uniswap V3 pool, and later operations targeted additional Uniswap V3 liquidity positions, according to the security teams cited by News.bitcoin.
Also read: Abstract to shut down Dec 15 after Igloo loses tens of millions
The market impact was severe. DEX data on Saturday showed some liquidity measures falling to just a few dollars, leaving sell orders exposed to large slippage. Holders were left with a token trading far below its prior range and a market with little depth.
Why it matters
Governance attacks are harder to patch than code bugs because the weakness sits in the rules rather than in a single contract. Projects that give token holders immediate control over a treasury can be captured by anyone with enough capital, even temporarily borrowed capital, and flash loans make that capital cheap to rent. For holders, the loss is not limited to the stolen funds: the collapse in liquidity means exit prices can fall far below the last quoted value.
What to watch
X 100 Global had not acknowledged the breach or commented on its social channels as of the report. The next signals are any official project statement, further tracing from Blockaid and Exvul of the remaining Freezer balance, and whether the Uniswap V3 positions tied to the attack are frozen or recovered.
Reported by news.bitcoin.com.
Source: Bitcoin.com News