X100 Global Senate Governance Takeover

On October 24, 2026, X100 Global lost approximately $4.85 million after an attacker used a flash loan to seize control of the project's on-chain governance "Senate" and push through a malicious treasury proposal. Monitoring firm Blockaid flagged the ongoing exploit on Ethereum mid-morning US time, and the project's X token subsequently collapsed by more than 96%.

What happened

X100 Global governed its treasury through a three-seat "Senate" whose membership was ranked by live "frozen" stake, with no voting snapshot, no minimum holding period, and no execution delay between proposing, voting, and executing. According to BlockSec, Blockaid, and a DeFiHackLabs reconstruction, the attacker exploited that design rather than a conventional coding bug.

The attacker borrowed roughly 1.94 million USDT from Aave, bought X tokens on a deep Uniswap pool, and routed them into helper contracts to occupy two of the three Senate seats within a single transaction. Holding a majority, the attacker then proposed, voted on, and executed a treasury action in the same block: a malicious proposal moved 400,000 X out of the project's "Freezer" treasury into an attacker-controlled Uniswap V3 pool, returning only about 36 USDT to the treasury. The attacker sold the extracted tokens, and Blockaid traced roughly $4.85 million in USDT proceeds across the operation. BlockSec put the figure slightly lower, at about $4.75 million.

Aftermath

As of the initial disclosures, X100 Global had not published an official statement, named a root cause, or reported any recovery. Blockaid and Exvul publicized the incident while it was still developing; around 12.2 million X reportedly remained in the Freezer in Blockaid's cited update. The X token fell from the $50–60 range to roughly $1.75, and liquidity across several decentralized pools evaporated to near zero. No attacker identity, wallet label, or confirmed on-chain address had been established in public reporting.

Why it matters

X100's loss is a textbook flash-loan governance takeover: when voting power can be rented for one block and a proposal can be created, approved, and executed without a snapshot or timelock, an attacker needs no coding bug to empty a treasury. It is the same class of attack that let a $1B flash loan buy 67% of Beanstalk governance long enough to drain $182M, and it rhymes with the collateral-and-voting manipulation behind Mango Markets. The defense is boring but decisive — vote snapshots that predate the proposal, minimum holding periods, and a mandatory delay between a passing vote and its execution — and X100 had none of them.