← The Polylog Crypto Intelligence Brief
Morning Edition · Monday, October 26, 2026Published at 1:45 AM EDT · New York
Flash-Loan Governance Takeover Drains About $4.85 Million From X100 on Ethereum
The attacker bought two of three seats on X100's "Senate", voted and executed a treasury sale for about 36 USDT in one transaction, and the X token fell 96%.
An attacker used borrowed money to take control of X100's governance on Oct. 24 and ordered the project's treasury to sell its own assets to the attacker. The DeFiHackLabs proof of concept classifies the incident as a "same-block governance capture" on Ethereum. A follow-up commit makes the attack reproducible against a forked mainnet.
The mechanics are simple. X100's governing body, called the Senate, let anyone join instantly for a fee of 100 X tokens and gave seats to the holders of the largest balances locked in a "Freezer" contract. According to a technical breakdown on DEV Community, the attacker took a flash loan, bought X tokens, split them between two attacker-controlled contracts, and locked them in the Freezer. That won two of the three Senate seats inside a single transaction. Proposals could be voted on and executed in the same transaction, with no snapshot of earlier balances, no minimum holding period, and no timelock. The captured Senate then made the treasury sell 400,000 X tokens for about 36 USDT into a pool the attacker had created earlier in the same transaction. The swap set its minimum output to zero.
The first transaction netted about $4.75 million in USDT. Security firm Blockaid counted about 4.85 million USDT and roughly 550,000 X tokens taken across three transactions. The Crypto Times reports that the X token fell 96%. No freeze, recovery, or attribution has been reported.
No contract code malfunctioned. The governance system did what it was written to do. It measured voting power at the one moment when power could be rented for the cost of a flash-loan fee, the same flaw that cost Beanstalk about $182 million in April 2022.
What this means
Flash loans make capital free for the length of one transaction, so any governance or reward system that reads balances at the moment of action belongs to whoever can borrow the most. The holders of small and mid-cap governance tokens are exposed, along with treasuries that let votes execute without delay. The defenses are well known (balance snapshots taken at an earlier block, minimum holding periods, and timelocks), and the Beanstalk loss in 2022 led many large protocols to adopt them. The lesson has not reached many smaller, less prominent projects, where teams often remove timelocks to make governance faster and lose that protection. The desk's read is that copycat attackers will scan other contracts for same-transaction vote-and-execute patterns over the coming weeks, and the most likely victims are small treasuries on Ethereum and BNB Chain. The read would be wrong if the next several governance incidents involve token holders who accumulated over time rather than borrowed votes.
Part of a tracked trend
Losses Move to Components That Worked as Designed
A growing share of DeFi losses will come not from buggy contract code but from components behaving exactly as specified — oracle forwarders, validator signature sets, governance votes and other trusted off-contract inputs — so audits and bug bounties scoped to on-chain code keep missing the failure surface, and protocols will be repeatedly forced to extend review, scope and monitoring to their privileged operational infrastructure.
Townsquare
Start a discussion in Townsquare.
More from this edition
- Electrum Patches Flaw That Let Malicious Servers Steal Bitcoin During Fee Bumps
- Initia Exploit Minted Unbacked Tokens and Emptied Its USDC Bridge Reserve to $63
- CoinDCX Admits $15.99 Million USDT Loss From Retired Wallets After Chief Executive Called Reports a False Alarm
- Bitget Hacker Resumes Laundering as October's Security Roundup Adds Ledger Implants and Balancer's Wind-Down
- A Live Ethereum Rollup Drops Elliptic-Curve Signatures for Hash Chains as Post-Quantum Designs Move Toward Production
- Lido Opens Permissionless Ethereum Validators of Up to 2,048 ETH Behind a 32 ETH Operator Bond
- Miden Launches a Private-Finance Stack Built on a Confidential Circle Dollar as Privacy Layer 2s Court Institutions
Comments
1Oct 26, 5:45 AM
The 36 USDT sale price was about 0.0007% of the roughly $4.85 million drained, and the two seats cost only two 100 X entry fees plus flash loan fees and trading costs.