X100 Loses $4.85M in Flash-Loan Governance Attack
X100 suffered a governance exploit that allowed attackers to realize about $4.85 million in USDT after using a flash loan to take control of the project’s on-chain voting system, according to a Blockaid alert on X. The security firm said the attack centered on a takeover of X100’s governance, rather than a direct drain through a conventional smart-contract bug.
🚨 Blockaid detected an ongoing exploit on X100 on Ethereum.
An attacker seized two of three Senate seats and sold 400,000 X from the treasury into an empty pool they created. A second attacker later burned the Freezer’s Uniswap V3 positions. ~$4.85M USDT realized so far across…— Blockaid (@blockaid_) October 24, 2026
On-chain breakdowns shared by security researchers indicate the exploit used temporary borrowed capital to gain enough voting power to push through actions against the protocol’s treasury. In that sequence, the attacker was able to steer treasury funds into transactions that produced the reported stablecoin proceeds.
How the governance takeover worked
Reports on the exploit describe a flash-loan-driven path that let the attacker briefly amass sufficient influence in X100’s governance to pass proposals within the same transaction. That design made the voting system itself the attack surface, with no need for the attacker to hold the governance position for long.
Blockaid’s alert said the realized value was roughly $4.85 million in USDT. A separate security firm breakdown pointed to the same exploit path and described the mechanics of the governance manipulation in more detail, including the on-chain steps that let the attacker gain control before the transaction was completed.
Based on the details shared so far, the incident appears to have combined flash-loan liquidity, governance control and treasury execution in a single exploit flow. That means the loss was tied to how X100’s voting process could be gamed under transaction-level conditions, rather than to price volatility or broader market movement.
The extent of any remaining exposure was not clear from the posted materials. What is clear is that X100’s governance layer, not just its token transfers, was at the center of the attack.
