Attackers seized control of the X100 protocol’s governance on Saturday using a flash loan, sold treasury tokens and extracted about $4.85 million as the project’s X token crashed 96.52% to $1.78, according to CryptoTimes.
Summary
- Attackers borrowed 1,942,457.64 USDT in an Aave flash loan and used it to buy two of the three “Senate” seats that control X100 governance.
- With governance control, they sold 400,000 treasury X tokens for just 35.68 USDT and realized about $4.85 million in total.
- The X token fell 96.52% to $1.78, and security firm Blockaid flagged the attack as ongoing.
- Roughly 12.2 million X tokens remain exposed while the situation develops.
The attack exploited the protocol’s governance design rather than its token contract. Because voting power could be bought outright, borrowed funds were enough to take control — no long-term holding was required.
Two of three seats, bought with borrowed money
The attackers took a flash loan of 1,942,457.64 USDT from Aave and used the funds to acquire two of the three seats in X100’s “Senate,” the body that governs the protocol. Flash loans are repaid within the same transaction block, which means the control was effectively rented rather than owned.
Once in control, the attackers sold 400,000 X tokens from the treasury for 35.68 USDT — a fraction of their market value — and extracted approximately $4.85 million in USDT overall.
Security firm Blockaid raised the alarm on X while the attack was still unfolding.
The governance lesson
The X100 case is a textbook flash-loan governance attack: any system where voting power follows a balance that can be borrowed in a single transaction can be captured by whoever can raise the largest short-term loan. Defenses used elsewhere include time-locked voting, snapshot-based voting power taken before a proposal opens, and quorum rules that cannot be met by a single holder.
About 12.2 million X tokens remain exposed, according to the reporting, and Blockaid described the incident as ongoing — holders should avoid interacting with unofficial recovery or refund offers, a common follow-up scam after publicized exploits.
