X100 Global Senate Governance Takeover
A flash loan bought two of three governance Senate seats in a single block, passing a malicious proposal that drained roughly $4.85M from X100 Global's treasury.
Vuln-watch · relayed from a public source; see Source & attribution below
Summary
A flash loan bought two of three governance Senate seats in a single block, passing a malicious proposal that drained roughly $4.85M from X100 Global's treasury.
Incident
- Victim: X100 Global
- Date (UTC): 2026-10-24
- Estimated loss: $4.8M
- Chain(s): Ethereum
- Attack type: flash-loan exploit
- Funds status: stolen
Recommended actions
- Revoke token approvals granted to X100 Global contracts until the project confirms they are safe
- Integrators: pause or delist affected assets and monitor for attacker fund movements
- Beware of follow-on phishing: ignore unofficial "refund", "recovery", or "claim" links and DMs; use the project's verified channels only
Source & attribution
Full analysis on Blockchain Breaches, 0xCERT's incident archive: https://www.blockchainbreaches.com/en/breaches/x100-2026. Primary sources: https://news.bitcoin.com/security/x-100-global-loses-millions-as-three-seat-senate-is-hijacked/ ; https://phemex.com/news/article/x100-attackers-exploit-governance-system-to-drain-485m-in-treasury-tokens-and-liquidity-100918 ; https://cryptoadventure.com/x100-loses-4-85-million-as-flash-loan-attack-hijacks-governance/ ; https://www.kucoin.com/news/flash/x100-global-suspected-governance-attack-steals-4-75m-via-exploited-vulnerability.
References
- https://www.blockchainbreaches.com/en/breaches/x100-2026
- https://news.bitcoin.com/security/x-100-global-loses-millions-as-three-seat-senate-is-hijacked/
- https://phemex.com/news/article/x100-attackers-exploit-governance-system-to-drain-485m-in-treasury-tokens-and-liquidity-100918
- https://cryptoadventure.com/x100-loses-4-85-million-as-flash-loan-attack-hijacks-governance/
- https://www.kucoin.com/news/flash/x100-global-suspected-governance-attack-steals-4-75m-via-exploited-vulnerability
- https://github.com/SunWeb3Sec/DeFiHackLabs/pull/1310
Indicators of compromise
All IOC feeds →- address0x37541fc4a6f1ec86889ba506f51dc39f2bedd10aX100 exploit coordinator contract (per Exvul) · Ethereum
- address0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63X100 attacker (per Exvul) · Ethereum
- tx0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0X100 Senate-takeover attack transaction (per BlockSec Phalcon and Exvul) · Ethereum
OpenPGP-signed. The signed text of this advisory verifies against the 0xCERT key CCC7 D9EC 9415 723D.
Published 2026-10-24 · last updated 2026-10-25
curl -s https://www.0xcert.com/pgp.asc | gpg --import && curl -s https://www.0xcert.com/advisory/0xCERT-2026-0275/signed.txt | gpg --verify