Attackers use flash loans to seize two of three seats on X100's Senate and drain up to $4.85 million on Ethereum

X100 (Ethereum, $4.75 million to $4.85 million, governance attack). On October 24, an attacker took control of X100 Global's three-seat Senate and emptied the project's treasury. DeFiHackLabs has added a proof-of-concept reconstruction of the attack. According to reporting on the exploit, the attacker took out a flash loan, bought X tokens, and split them between two newly deployed contracts. Each contract staked slightly more than 19,000 X in X100's "Freezer" system. That pushed out existing Senate members and gave the attacker two of three seats. With that majority, the attacker forced the treasury to sell assets into a pool the attacker controlled. The root cause was design, not a coding mistake. Governance had no voting snapshot, no minimum stake age and no delay between approval and execution. The proceeds were converted to ether (ETH) and split across four wallets. The labeled exploiter address then deposited 821.2 ETH into Tornado Cash. No recovery or attribution has been reported.

Argent-style smart wallet (Ethereum, about $59,800, signature replay). On October 19, an attacker drained wallets built on an Argent-derived design in two transactions that lasted about one minute. DeFiHackLabs has published a reconstruction, revised it and merged it. An analysis of the incident found two flaws. The relayed-signature path checked the owner or guardian signature but never used up a nonce. The deadline check also overflowed, so years-old signatures still passed. The attacker replayed the same signed bytes 19 times and then 9 times. That made the victim wallets buy MARK repeatedly in a thin Uniswap V2 pool, while the attacker traded against those purchases to profit from the price moves. SlowMist put the loss at about $59,800. Public reports say the deployment was not the official Argent wallet.

Older incidents with updates. Rekt News has been revisiting several recent cases. NEAR Intents lost $3.87 million from a BNB Chain vault over September 30 and October 1. An attacker used an interaction between the Omni bridge's deposit and withdrawal paths and the intents contract to create unbacked balances, then withdrew them as real USDT. The team named the wallet publicly, and the attacker returned all of the funds. The crypto casino Duelbits lost about $7 million from its hot wallets on September 24 in a suspected private-key compromise. As of October 19, most of the money had not been recovered, no attacker had been named, and Duelbits had offered an on-chain bounty. Balancer token holders voted 99.2% to wind down the protocol 11 months after a $128 million exploit, which came from a rounding error in a v2 scaling function. Rekt reports that the pools move to withdrawals-only on October 30 and that redemptions are expected to open in May 2027 at about $0.158 per BAL.