The short version
- X100 hack: on October 24 an attacker used a $1.94 million Aave flash loan to win two of the three Senate seats that run X100’s treasury, voted to sell 400,000 X for $35.68 and kept 4.75 million USDT.
- Seats went to the biggest live balance and a proposal could pass and execute in the same transaction, so a few seconds of borrowed money beat the real holders; the X token fell about 96%, from $51 to $1.75.
- The crew is watching the 1,201.5 ETH (about $2.8 million) still sitting in three attacker wallets after 821.2 ETH went into Tornado Cash on October 26.
The X100 hack didn’t need a stolen key or a clever bug, only the project’s own rulebook, which is what sets it apart from the usual DeFi exploit. On Saturday, October 24, an attacker borrowed $1.94 million for a single transaction, bought enough X tokens to win two of the three seats on X100’s “Senate”, and voted to sell 400,000 X from the treasury for $35.68.
The attacker walked off with 4,749,726 USDT. The X token fell about 96%, from roughly $51 to $1.75. So how does a vote get bought with borrowed money, and where did the $4.75 million go?
Blockaid’s alert came 38 minutes after the attack transaction landed:
🚨 Blockaid detected an ongoing exploit on X100 on Ethereum.
An attacker seized two of three Senate seats and sold 400,000 X from the treasury into an empty pool they created. A second attacker later burned the Freezer’s Uniswap V3 positions. ~$4.85M USDT realized so far across
What Happened in the X100 Hack?
X100 is an Ethereum token whose treasury sits in a smart contract called the Freezer. Holders lock X there, and the three biggest locked balances among Senate applicants hold the three seats. Those seats decide what the treasury does with its X and its Uniswap positions.
At 14:11:47 UTC, one transaction did everything. It took a flash loan of 1,942,457 USDT from Aave, bought 38,200 X, and split it between two fresh helper contracts. Each one paid the 100 X fee to apply and locked 19,000.000001 X. That’s one millionth of a token more than the second-ranked senator had locked, and enough to push out the two smaller seat holders.
Sponsored · Affiliate link
Save 20% on fees trading on WEEX
Base Camp may earn a commission if you sign up. It never affects what we write.
How Did a Flash Loan Win the Vote?
Because nothing in the rules checked time. With two seats, one helper proposed a treasury swap and the other voted yes, and the proposal executed in the same call. No snapshot of who held what yesterday, no minimum lock period, no timelock giving real holders a day to react.
The swap itself was the robbery. It sent 400,000 X through a PancakeSwap pool the attacker had created moments earlier with about $100 in it, and the minimum the treasury would accept was zero. The treasury got $35.68 back. The attacker then sold 131,703 of those X into X100’s real Uniswap pool for 6.69 million USDT, repaid Aave and kept the rest. On-chain investigators at Bitquery found that much of that pool money had arrived minutes earlier, from Senate members buying X.
It didn’t end there. Blockaid counts about $4.85 million taken across the day: a second attacker used the same route 24 minutes later with a Morpho flash loan and took $96,382, and a third wallet pulled about 550,000 X through seats the second attacker left open to anyone.
SIDE TRAIL: Crypto Hacks Fell to $129M in October, and DeFi Had Its Quietest Month of 2026
Where Did the Stolen $4.75M Go?
Into ETH within eight minutes, then into Tornado Cash two days later. We followed it on-chain. The attacker’s wallet swapped the USDT for 2,022.86 ETH by 14:19 UTC, moved it to a second wallet, and split 1,602 ETH across four new addresses, 400.5 ETH each.
On Monday between 13:09 and 13:56 UTC, 821.2 ETH (about $1.9 million) went into Tornado Cash, the Ethereum mixer that breaks the trail between deposit and withdrawal. That was 420.8 ETH straight from the second wallet and 400.4 ETH from one of the four. The other three still hold 1,201.5 ETH, worth about $2.8 million at $2,319.
Unlike stolen USDT, ETH can’t be frozen by an issuer. Once it’s mixed, it’s gone.
What Does the X100 Hack Mean for Governance Tokens?
Check how fast a vote can turn into money. If seats or votes count the balance at the moment of voting, and a proposal can pass and execute in the same block, anyone with a flash loan is a voter for free. Snapshots, a lock period or a timelock would each have stopped this one on their own.
The same weekend brought a quieter warning for Bitcoin users. Electrum published an advisory on October 24: a malicious server could swap in a fake unconfirmed transaction paying the attacker, and if you bumped its fee, your wallet signed it. It has been used against real users. Electrum 4.8.3 fixes it; until you update, check the address and amount before every fee bump.
TRAIL MAP: DeFi Basics: Swaps, Liquidity Pools and Impermanent Loss
The X100 hack was a governance attack, not a code exploit, and that makes it easy to repeat elsewhere. Whether X100 can reclaim its Senate, and whether the last $2.8 million in ETH follows the rest into Tornado Cash, is what to watch next.
In crypto since 2017. A technical trader with years of experience in DeFi and onchain data.
More from TANG →
