# Flash-Loan Governance Takeover Drains About $4.85 Million From X100 on Ethereum

The attacker bought two of three seats on X100's "Senate", voted and executed a treasury sale for about 36 USDT in one transaction, and the X token fell 96%.

- Published: 2026-10-26T05:45:33.692Z
- Canonical: https://polylog.news/crypto/2026-10-26/flash-loan-governance-takeover-drains-about-4-85-million-fro
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/56adc62f45a4774c4d584014b3e5284b0f4d5742), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/d75fde215e73eb54d2f94307044e7fd196fa98e4), [DEV Community (Panda Security)](https://dev.to/pandasecurity/x100-exploit-a-flash-loaned-senate-drained-475m-hfi), [The Crypto Times](https://www.cryptotimes.io/2026/10/24/x100-hack-attackers-hijack-governance-drain-4-85m-as-x-token-crashes-96/), [KuCoin News (Blockaid report)](https://www.kucoin.com/news/flash/security-firm-blockaid-reports-ongoing-attack-on-x100-4-85m-usdt-stolen)

An attacker used borrowed money to take control of X100's governance on Oct. 24 and ordered the project's treasury to sell its own assets to the attacker. The [DeFiHackLabs proof of concept](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/56adc62f45a4774c4d584014b3e5284b0f4d5742) classifies the incident as a "same-block governance capture" on Ethereum. A [follow-up commit](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/d75fde215e73eb54d2f94307044e7fd196fa98e4) makes the attack reproducible against a forked mainnet.

The mechanics are simple. X100's governing body, called the Senate, let anyone join instantly for a fee of 100 X tokens and gave seats to the holders of the largest balances locked in a "Freezer" contract. According to [a technical breakdown on DEV Community](https://dev.to/pandasecurity/x100-exploit-a-flash-loaned-senate-drained-475m-hfi), the attacker took a flash loan, bought X tokens, split them between two attacker-controlled contracts, and locked them in the Freezer. That won two of the three Senate seats inside a single transaction. Proposals could be voted on and executed in the same transaction, with no snapshot of earlier balances, no minimum holding period, and no timelock. The captured Senate then made the treasury sell 400,000 X tokens for about 36 USDT into a pool the attacker had created earlier in the same transaction. The swap set its minimum output to zero.

The first transaction netted about $4.75 million in USDT. Security firm [Blockaid counted about 4.85 million USDT](https://www.kucoin.com/news/flash/security-firm-blockaid-reports-ongoing-attack-on-x100-4-85m-usdt-stolen) and roughly 550,000 X tokens taken across three transactions. [The Crypto Times reports](https://www.cryptotimes.io/2026/10/24/x100-hack-attackers-hijack-governance-drain-4-85m-as-x-token-crashes-96/) that the X token fell 96%. No freeze, recovery, or attribution has been reported.

No contract code malfunctioned. The governance system did what it was written to do. It measured voting power at the one moment when power could be rented for the cost of a flash-loan fee, the same flaw that cost Beanstalk about $182 million in April 2022.

## What this means

Flash loans make capital free for the length of one transaction, so any governance or reward system that reads balances at the moment of action belongs to whoever can borrow the most. The holders of small and mid-cap governance tokens are exposed, along with treasuries that let votes execute without delay. The defenses are well known (balance snapshots taken at an earlier block, minimum holding periods, and timelocks), and the Beanstalk loss in 2022 led many large protocols to adopt them. The lesson has not reached many smaller, less prominent projects, where teams often remove timelocks to make governance faster and lose that protection. The desk's read is that copycat attackers will scan other contracts for same-transaction vote-and-execute patterns over the coming weeks, and the most likely victims are small treasuries on Ethereum and BNB Chain. The read would be wrong if the next several governance incidents involve token holders who accumulated over time rather than borrowed votes.

## What to watch

- Whether security firms publish scans of other contracts that share X100's governance pattern, which would show how many treasuries face the same risk.
- Whether the stolen USDT moves toward mixers or exchanges, and whether Tether freezes any of it, which would decide if any funds are recoverable.
- Whether X100 announces a compensation plan or winds down, because with its token down 96% the project has little left to fund one.