Three wallets used X100’s own governance system to remove about $4.85 million in USDT from the token’s only trading pool on 24 October, according to Bitquery’s transaction-level reconstruction. The first attacker won two of the protocol’s three Senate seats by locking one millionth of an X token more than the stake it needed to beat. Bitquery
The attacker borrowed almost $2 million through a flash loan, bought the governance positions and passed a proposal forcing the treasury to sell 400,000 X into a pool the attacker had created moments earlier. The proposal set the minimum acceptable price to zero. X100’s treasury received $35.68, while the attacker extracted about $4.75 million and repaid the loan.
A second attacker removed another $96,382 and routed proceeds through ChangeNOW. Bitquery found that the first attacker’s 2,022.86 ETH remained unmoved across five wallets at its latest check. The analysis also found that two Senate seats were still held by helper contracts callable by anyone, although the treasury’s limit for supplying X to markets had been exhausted.
The chain establishes the votes, proposal execution, asset swaps and destination wallets. It does not establish the attackers’ identities. Bitquery also could not verify that an on-chain return-for-bounty message came from the X100 team, and the project had not posted a public response when the researchers checked.
TOKEN RECON ASSESSMENT
This was not an external key compromise. The authorization model itself allowed temporary capital to become governance power, accepted an attacker-created pool and permitted a zero minimum price. A credible recovery begins with revoking the open Senate path and publishing a contract-level postmortem. The unmoved 2,022.86 ETH provides a concrete tracing target, but it is not evidence that funds will be returned.
Sources
