# Attackers Use Bought and Borrowed Votes to Take Over X100, Arkadiko and Yapeswap Governance

X100 lost about 4.85 million USDT, or roughly $6 million counting later transactions, after an attacker used a flash loan to win two of its three governance "Senate" seats in one Ethereum transaction. Arkadiko lost about $1.09 million two days earlier through the same weakness.

- Published: 2026-10-28T05:45:35.192Z
- Canonical: https://polylog.news/crypto/2026-10-28/attackers-use-bought-and-borrowed-votes-to-take-over-x100-ar
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [CryptoSlate](https://cryptoslate.com/x100-governance-flaws-trigger-6m-loss-due-to-a-flash-loan/), [DeFiHackLabs (Yapeswap zero-quorum PoC)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/78b5b666fc002a61ea33bf5177f91b3e961f1047), [DeFiHackLabs (Yapeswap governance-capture PoC)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/6b2c3e91c4435596a724d1d702f1f0c7800ff47e), [DeFiHackLabs (incident count 902)](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/add02a8dd15d31565818be307eee778d506a7ec4), [CCN](https://www.ccn.com/news/crypto/x100-hack-governance-exploit-treasury-drain/), [Bitcoin.com News](https://news.bitcoin.com/security/x-100-global-loses-millions-as-three-seat-senate-is-hijacked/), [DEV Community (Panda Security)](https://dev.to/pandasecurity/yapeswap-exploit-zero-quorum-handed-over-the-factory-46p4), [PANews (SlowMist)](https://panews.io/articles/01a17275-c583-7613-86e8-bccf64f7b391)

Three decentralized finance (DeFi) protocols lost funds in one week to the same failure. In each case, an attacker obtained enough voting power to pass a malicious proposal, and the governance contract executed it exactly as written. No contract bug was involved in the usual sense. The attacker followed the rules as coded.

The largest case was X100 Global, an Ethereum project. At 14:11:47 UTC on October 24, according to [Bitcoin.com News](https://news.bitcoin.com/security/x-100-global-loses-millions-as-three-seat-senate-is-hijacked/) and [CCN](https://www.ccn.com/news/crypto/x100-hack-governance-exploit-treasury-drain/), the attacker borrowed about 1.94 million USDT through an Aave flash loan (a loan that must be borrowed and repaid within one transaction). The attacker used it to buy X tokens and registered helper contracts that took two of the project's three Senate seats. The attacker then passed a proposal that moved treasury funds out. Security firm BlockSec put the direct theft at about 4.85 million USDT. [CryptoSlate](https://cryptoslate.com/x100-governance-flaws-trigger-6m-loss-due-to-a-flash-loan/) puts the total near $6 million once later transactions are counted, and it reports that the attacker repaid the flash loan from the stolen funds while its own stake stayed locked. X100's governance had no voting snapshots, no minimum holding period and no delay before execution, so votes bought seconds earlier counted in full.

Two days earlier, on October 22, Arkadiko, a lending and stablecoin protocol on the Stacks network, lost about $1.09 million. An attacker bought enough DIKO, Arkadiko's governance token, to pass a proposal alone that installed a malicious contract. CryptoSlate reports that Arkadiko's ballot counted tokens bought after the vote opened.

The smallest case shows the extreme form of the flaw. On October 25 an attacker drained Yapeswap, a small decentralized exchange on Ethereum built on the Uniswap V2 design, of about $21,900, according to [SlowMist via PANews](https://panews.io/articles/01a17275-c583-7613-86e8-bccf64f7b391). Its WorkersUnion governance contract required no minimum quorum. A proposal backed by about 0.000055% of voting power passed and handed the attacker the factory's admin role, [according to a technical post-mortem](https://dev.to/pandasecurity/yapeswap-exploit-zero-quorum-handed-over-the-factory-46p4). The attacker then pointed the factory at a malicious registry. Each trading pair's public rebalance function moved its reserves into a fake vault, which issued no redeemable shares. DeFiHackLabs, the open-source incident archive, has already published [two](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/78b5b666fc002a61ea33bf5177f91b3e961f1047) proof-of-concept [reproductions](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/6b2c3e91c4435596a724d1d702f1f0c7800ff47e) of the Yapeswap attack and [raised its incident count to 902](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/add02a8dd15d31565818be307eee778d506a7ec4).

None of the reports reviewed by this desk show frozen or recovered funds or a public identification of any of the three attackers.

## What this means

These three attacks share a single economic logic. If buying or borrowing a voting majority costs less than the treasury that majority controls, an attacker will take the treasury. Protocols whose governance tokens are illiquid or mispriced relative to the assets their votes control are most exposed, including many older or abandoned decentralized organizations that never added snapshots or timelocks. The precedent is Beanstalk, which lost about $182 million to a flash-loan governance attack in April 2022. After that loss, large protocols adopted snapshot voting and execution delays, but these three cases show that smaller ones did not. The market treats governance attacks as an old, solved problem, and that view is wrong for small and legacy protocols. Public proof-of-concept code now makes these attacks easier to copy. The desk's read is that more governance takeovers of small and dormant protocols are likely within weeks. That holds as long as treasuries keep exceeding the cost of reaching quorum, and published reproductions keep lowering attackers' preparation costs. The forecast fails if the next month brings no new governance-capture incident, or if affected protocols add timelocks quickly. Large protocols with delayed execution are not the targets. Holders of small governance tokens tied to large treasuries carry the risk.

## What to watch

- Whether other small Ethereum protocols announce emergency timelocks, snapshot voting or quorum changes this week. Fast changes would show teams treat the method as an active threat.
- Whether any X100 or Arkadiko funds reach a centralized exchange that freezes them. That will decide whether victims recover anything.
- Whether security firms begin publishing lists of treasuries whose value exceeds the market cost of a voting majority. Such lists would show both defenders and attackers where the next targets are.