X100 governance exploit: flash-loaned Senate seats

Phalcon: 'estimated loss of $4.75M'. Blockaid: '~$4.85M USDT realized plus ~550k X extracted across 3 txs'. Figures differ; both attributed, not reconciled.

Root cause: Per BlockSec Phalcon: 'a governance design flaw that allowed the attacker to acquire two of three Senate seats using flash-loan-funded X tokens and immediately approve and execute a malicious treasury proposal within the same transaction.' The proposal swapped 400,000 X into an attacker-supplied PancakeSwap V3 X-USDT pool with minimum output zero, for about 35.68 USDT. X100 has not published a cause.

Timeline, as sourced: 24 Oct 2026: first alert 14:49 UTC (Blockaid); Phalcon analysis 15:44 UTC.

On 24 October 2026 attackers took over the governance of X100, an Ethereum token project. According to BlockSec Phalcon (opens in a new tab), the attacker bought X tokens with a flash loan, sent them to two attacker-controlled contracts and froze them in the Freezer to claim two of the three Senate seats, and approved and executed a treasury proposal in the same transaction. The proposal swapped 400,000 X from the Freezer into a pool the attacker had created, with minimum output set to zero, for about 35.68 USDT; the attacker then withdrew the liquidity, sold part of the X and repaid the flash loan. Phalcon estimates the loss at $4.75 million. Blockaid (opens in a new tab) reports about $4.85 million in USDT realized plus about 550,000 X across three transactions by separate attackers, including one that used the same Senate path (opens in a new tab). X100 has not published a statement. Developing.