Attackers Use Bought and Borrowed Votes to Take Over X100, Arkadiko and Yapeswap Governance

Three decentralized finance (DeFi) protocols lost funds in one week to the same failure. In each case, an attacker obtained enough voting power to pass a malicious proposal, and the governance contract executed it exactly as written. No contract bug was involved in the usual sense. The attacker followed the rules as coded.

The largest case was X100 Global, an Ethereum project. At 14:11:47 UTC on October 24, according to Bitcoin.com News and CCN, the attacker borrowed about 1.94 million USDT through an Aave flash loan (a loan that must be borrowed and repaid within one transaction). The attacker used it to buy X tokens and registered helper contracts that took two of the project's three Senate seats. The attacker then passed a proposal that moved treasury funds out. Security firm BlockSec put the direct theft at about 4.85 million USDT. CryptoSlate puts the total near $6 million once later transactions are counted, and it reports that the attacker repaid the flash loan from the stolen funds while its own stake stayed locked. X100's governance had no voting snapshots, no minimum holding period and no delay before execution, so votes bought seconds earlier counted in full.

Two days earlier, on October 22, Arkadiko, a lending and stablecoin protocol on the Stacks network, lost about $1.09 million. An attacker bought enough DIKO, Arkadiko's governance token, to pass a proposal alone that installed a malicious contract. CryptoSlate reports that Arkadiko's ballot counted tokens bought after the vote opened.

The smallest case shows the extreme form of the flaw. On October 25 an attacker drained Yapeswap, a small decentralized exchange on Ethereum built on the Uniswap V2 design, of about $21,900, according to SlowMist via PANews. Its WorkersUnion governance contract required no minimum quorum. A proposal backed by about 0.000055% of voting power passed and handed the attacker the factory's admin role, according to a technical post-mortem. The attacker then pointed the factory at a malicious registry. Each trading pair's public rebalance function moved its reserves into a fake vault, which issued no redeemable shares. DeFiHackLabs, the open-source incident archive, has already published two proof-of-concept reproductions of the Yapeswap attack and raised its incident count to 902.

None of the reports reviewed by this desk show frozen or recovered funds or a public identification of any of the three attackers.