-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0273
============================================================

Advisory-ID:  0xCERT-2026-0273
Severity:     High
Published:    2026-10-24T15:44:58.000Z
Updated:      2026-10-25T04:42:55.691Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0273

Title: X100 Global on Ethereum drained of about $4.75M-$4.85M via flash-loan-funded Senate governance takeover

Summary
- -------
An attacker used flash-loaned funds to take two of X100 Global's three Senate seats and immediately execute a treasury proposal that dumped 400,000 X into an attacker-seeded pool, realising about $4.75M-$4.85M in USDT. Avoid interacting with X100 Freezer/treasury governance until the project publishes guidance.

Details
- -------
Summary
On 24 October 2026 X100 Global (X token, Ethereum) suffered a governance takeover. Per BlockSec Phalcon and Exvul, the attacker bought X with flash-loaned funds, froze it in the Freezer through two helper contracts to win two of the three Senate seats, and in the same transaction passed and executed a treasury proposal that swapped 400,000 X into an attacker-seeded PancakeSwap V3 X-USDT pool with minimum output set to zero, returning only about 35.68 USDT to the treasury. Blockaid separately reported that a second attacker later burned the Freezer's Uniswap V3 positions.

Affected
- - X100 Global Freezer / DexTreasury governance (Senate) on Ethereum
- - No fix available at time of publication; no official project statement had been issued at the time of the cited reports

Impact
BlockSec estimates the loss at about $4.75M; Exvul says the attacker realised 4.75M USDT; Blockaid reported about $4.85M USDT realised across two transactions and described the attack as still ongoing at 14:49 UTC on 24 October. Figures differ between sources, likely because they were taken at different times. Exvul attributes the root cause to applyForSenate() allowing anyone to join immediately for a 100-X fee while seats are chosen from current frozen balances, with no voting-power snapshot, stake-age delay, or execution timelock. Secondary coverage reports the X token fell more than 96%.

Recommended actions
- - Do not buy, provide liquidity for, or freeze X until X100 Global publishes an incident statement
- - Exchanges and wallets: flag the attacker addresses and transaction listed in the IOCs
- - Protocol designers: governance that grants control from current balances must use snapshots, holding periods, and execution timelocks

Source & attribution
This 0xCERT advisory summarises alerts by BlockSec Phalcon (https://x.com/Phalcon_xyz/status/2114020331925258732), Exvul (https://x.com/exvulsec/status/2114032078996332573), and Blockaid (https://x.com/blockaid_/status/2114006384735916278). Indicators are copied from the Exvul and BlockSec alerts. Details may change; refer to the original sources for the authoritative record.

References
- ----------
- - https://x.com/Phalcon_xyz/status/2114020331925258732
- - https://x.com/exvulsec/status/2114032078996332573
- - https://x.com/blockaid_/status/2114006384735916278
- - https://etherscan.io/tx/0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0
- - https://news.bitcoin.com/security/x-100-global-loses-millions-as-three-seat-senate-is-hijacked/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmreCtwJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmeSeBNHPo3AXkvqMNzfYSA6L0T4xzsLFivOY1MH
rSjaWxYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABiaQD/UmwyJzpzliFJ78OU
R8iIDWbyrVPv0fNzaYLmUNVPr88BAMkpzXQLbIkKLDU9guNTCRe6Alllk0V+
SxR7dd08AZkE
=fVbB
-----END PGP SIGNATURE-----