X100 Global on Ethereum drained of about $4.75M-$4.85M via flash-loan-funded Senate governance takeover

Summary

On 24 October 2026 X100 Global (X token, Ethereum) suffered a governance takeover. Per BlockSec Phalcon and Exvul, the attacker bought X with flash-loaned funds, froze it in the Freezer through two helper contracts to win two of the three Senate seats, and in the same transaction passed and executed a treasury proposal that swapped 400,000 X into an attacker-seeded PancakeSwap V3 X-USDT pool with minimum output set to zero, returning only about 35.68 USDT to the treasury. Blockaid separately reported that a second attacker later burned the Freezer's Uniswap V3 positions.

Affected

• X100 Global Freezer / DexTreasury governance (Senate) on Ethereum
• No fix available at time of publication; no official project statement had been issued at the time of the cited reports

Impact

BlockSec estimates the loss at about $4.75M; Exvul says the attacker realised 4.75M USDT; Blockaid reported about $4.85M USDT realised across two transactions and described the attack as still ongoing at 14:49 UTC on 24 October. Figures differ between sources, likely because they were taken at different times. Exvul attributes the root cause to applyForSenate() allowing anyone to join immediately for a 100-X fee while seats are chosen from current frozen balances, with no voting-power snapshot, stake-age delay, or execution timelock. Secondary coverage reports the X token fell more than 96%.

Recommended actions

• Do not buy, provide liquidity for, or freeze X until X100 Global publishes an incident statement
• Exchanges and wallets: flag the attacker addresses and transaction listed in the IOCs
• Protocol designers: governance that grants control from current balances must use snapshots, holding periods, and execution timelocks

Source & attribution

This 0xCERT advisory summarises alerts by BlockSec Phalcon (https://x.com/Phalcon_xyz/status/2114020331925258732), Exvul (https://x.com/exvulsec/status/2114032078996332573), and Blockaid (https://x.com/blockaid_/status/2114006384735916278). Indicators are copied from the Exvul and BlockSec alerts. Details may change; refer to the original sources for the authoritative record.