Ethereum DeFi project X100 suffered a governance exploit on Oct. 24 that resulted in the theft of about 4.85 million USDT. According to GMGN data, the market capitalization of the X token fell from roughly $760 million before the attack to about $24 million, a drop of more than 96% in one day.
The treasury had been managed by three Senate seats. By using flash-loaned capital to capture two of them, the attacker gained a voting majority, submitted a malicious proposal, and used the newly controlled seats to approve a transfer that sent treasury assets into the attacker’s own path. After the first exploit succeeded, other attackers used the same governance design to keep draining assets.
How the attacker captured two Senate seats
X100’s treasury was governed by a three-seat body called the Senate. Those members voted on actions including treasury token sales and liquidity deployment. Control of two seats was enough to pass proposals and move treasury assets.
To run for a seat, a holder had to deposit X tokens into the Freezer contract, choose a lock period of one, three, or five years, and pay a registration fee of 100 X. The three seats were assigned in real time based on the current locked balances of candidate addresses, with the top three addresses receiving governance power.
The design did not prevent one controller from winning seats through multiple addresses, and it did not impose any waiting period before governance rights became active. That meant an attacker only needed two controlled addresses to enter the top three at the same time to gain an immediate majority. Once a proposal passed, it could also be executed at once, allowing seat capture and asset transfer to happen inside a single transaction.
Before the exploit, the second-ranked seat had about 19,000 X locked. At 22:11 on Oct. 24, the attacker borrowed about 1.94 million USDT through an Aave flash loan, bought X, and distributed the tokens to two helper contracts that each completed the lockup and candidacy process. Each contract locked 19,000.000001 X, just one millionth of a token above the previous second seat, and the two addresses took the second and third positions at the same time.
How a malicious proposal sold 400,000 X for $35.68
After securing two seats, the attacker immediately submitted a malicious proposal instructing the treasury to sell 400,000 X into a PancakeSwap V3 X/USDT pool created by the attacker. The proposal set the minimum amount received to zero. A second controlled contract then voted in favor, giving the proposal two votes and immediate execution.
According to GoPlus, X100 allowed governance proposals to specify the trading pool but lacked effective protection on the minimum execution amount. In practice, the attacker could choose where the treasury sold tokens, define the execution terms, and then approve the trade with a self-controlled majority.
The pool was created in the same transaction and funded with only about $100 in liquidity. When the treasury sold 400,000 X into it, the pool could return only a tiny amount of USDT. Because the minimum amount out had been set to zero, the trade did not fail despite the poor execution. The treasury gave up 400,000 X and received only about $35.68.
The attacker then removed liquidity from the self-created pool, recovered the X, and sold part of those tokens into an existing Uniswap V3 X/USDT pool for USDT. After repaying the flash loan and related costs, the first attacker made about 4.75 million USDT in profit.
The full sequence — borrowing funds, buying X, taking Senate seats, approving a treasury sale at a near-zero return, cashing out, and repaying the loan — was completed in one transaction. Treasury tokens became the inventory used for the attacker’s exit, while USDT from a real trading pool was used to settle the loan and produce the gain.
Three exploit rounds in less than 30 minutes
About 24 minutes after the first exploit, a second attacker used a flash loan to seize two governance seats again, removed part of the Uniswap V3 liquidity position held by Freezer, and used a self-created pool to move more assets, taking about 96,400 USDT.
Roughly five minutes later, a third wallet used a helper contract left behind by the second attacker that did not restrict who could call it. By borrowing those governance seats, the wallet passed another proposal and moved about 550,000 X. The first two rounds caused losses of about 4.85 million USDT, while the third round moved an additional 550,000 X. All three rounds took place in under half an hour.
Bitquery traced the first attacker converting the main USDT proceeds into ETH within minutes of the exploit, then splitting the funds across five wallets for a total of about 2,022.86 ETH. The second attacker also converted USDT into ETH and routed the funds through an intermediary address to ChangeNOW, a process that took about 21 minutes.
Once governance control was lost, the drain quickly expanded from a single attacker’s transaction into a sequence of extractions by multiple wallets. Later participants did not even need to buy tokens and run for seats again. They could keep using permissions that had already been exposed.
Governance attacks are getting cheaper
X100 is not an isolated case, and governance exploits do not always require attackers to commit large amounts of capital upfront. Attackers can buy tokens to obtain voting power, exploit low proposal thresholds, or use flash loans so borrowed capital can be turned into temporary governance control.
Odaily pointed to several cases this year. In July, a Bonk DAO attacker spent about $4.09 million to buy tokens equal to 1.003% of supply, just enough to clear the governance approval threshold, then used a malicious proposal to move about $20.5 million in assets and later recovered the staked tokens after voting ended. In August, Term Finance lost about $8.5 million in a governance exploit. Even when millions of dollars are needed to acquire voting power, that does not always represent the attacker’s final economic cost.
Some failed attempts had much lower entry costs. In March, a Moonwell attacker spent only about $1,808 to buy MFAM and self-delegate, then submitted a malicious proposal seeking control over seven lending markets and core contracts tied to about $1.08 million in user funds. In September, an Olas attacker locked 5,100 OLAS at a cost of about $135, enough to cross the proposal threshold. Both attempts were stopped, but they showed that an attacker does not always need majority control. Proposal rights alone can create an opening.
On Oct. 22, Arkadiko also suffered a governance exploit. The attacker bought enough DIKO to pass a proposal introducing a malicious contract through a solo vote, with no opposing votes cast. Estimated losses were about $1.09 million.
The X100 case put the issue in plain view: governance power can be borrowed, and once a proposal passes, treasury assets can be moved out. If control of a treasury can change hands that quickly, governance design becomes inseparable from asset security.