Attackers Hijack X100's Three-Seat Senate With a Flash Loan, Drain $4.85M as Token Crashes 96%

Published October 25, 2026, 1:45 AM PKT. Based on Blockaid security alerts on October 24, 2026 and the on-chain transaction records they cite (primary source), The Crypto Times (secondary source) and Bitcoin.com (secondary source), both October 24, 2026.

Attackers seized control of X100, an Ethereum-based token project, on October 24, 2026, by buying their way into two of its three Senate seats with a flash loan, then used that majority to drain the project's treasury and liquidity, according to Blockaid alerts reported by The Crypto Times and Bitcoin.com. Across three transactions, the attackers collected about $4.85 million in Tether (USDT) plus about 550,000 X tokens, according to Blockaid, which described the attack as still in progress. The X token collapsed more than 96 percent in the same day, and X100 had issued no official statement as of Bitcoin.com's writing at 3 p.m. Eastern Time on October 24.

A flash loan bought two Senate seats

The first exploit transaction, confirmed at 14:11:47 UTC on October 24, opened with a flash loan of 1,942,457.64 USDT from Aave, according to The Crypto Times, citing the on-chain record. A flash loan is an uncollateralized loan that must be borrowed and repaid inside the same blockchain transaction. The attacker used the borrowed funds to buy 38,200 X from the Uniswap V3 X/USDT pool, then split the tokens between two newly deployed helper contracts, according to The Crypto Times. Each helper froze 19,000 X and paid a 100 X registration fee, after which the Freezer contract registered and ranked both as Senate members, according to the same report.

The Freezer is X100's staking system, according to The Crypto Times, citing X100's Etherscan token page. Holders freeze X for one, three or five years to earn rewards, and the same contract holds treasury assets and runs the Senate, the small group of top stakers that votes on treasury actions. With two of the three Senate seats now held by the attacker's helpers, a proposal was created, voted on by the two new senators, and executed inside the same transaction, according to The Crypto Times. The event log records two votes in favor from a three-member Senate, and the proposal's on-chain description read "testnet flash governance proof," according to the report.

400,000 X sold for 35.68 USDT

The approved proposal directed the Freezer to sell 400,000 X into a PancakeSwap V3 pool that the attacker had created moments earlier in the same transaction, according to The Crypto Times. The treasury received just 35.68 USDT for those tokens, according to the report. The attacker then pulled liquidity from that pool, recovering 399,986.8 X, and sold 131,702.92 X into the Uniswap V3 X/USDT pool for about 6.69 million USDT, according to The Crypto Times. After repaying the Aave flash loan, the attacker's contract sent 4,749,726.10 USDT to the attacker's address and kept roughly 268,284 X, according to the report. Bitcoin.com, citing the same security analysis, confirmed the shape of the trade: 400,000 X moved into an attacker-controlled pool for about 36 USDT, then the tokens were extracted and sold through a legitimate Uniswap V3 pool.

A third attacker burned the remaining liquidity

Blockaid later reported that a third attacker followed the same Senate route, according to The Crypto Times. A transaction at 14:40:47 UTC, sent from address 0xDAB1...F8c8, shows two newly seated Senate members passing a series of proposals that removed 549,999.4 X and 30.69 USDT from the Freezer's Uniswap V3 position and burned the position NFT, according to the report. About 549,916 X from that withdrawal ended up at an address controlled by the attacker, according to The Crypto Times. Blockaid also listed address 0xfc3f...E92F among the exploiter addresses, according to the report.

X falls 96 percent as 12.2 million tokens sit exposed

Etherscan market data showed X trading at $1.78 as of 17:38 UTC on October 24, a 96.52 percent decline, according to The Crypto Times. Bitcoin.com, citing CoinMarketCap DEX screener data, put the fall from the $50 to $60 range to approximately $1.75, a decline exceeding 96 percent, and reported that some liquidity measurements on decentralized exchanges fell to just a few dollars, leaving meaningful sell orders exposed to extraordinary slippage. The token has a maximum supply of 14 million X and 202 holders, according to The Crypto Times, citing Etherscan.

About 12.2 million X remained in the Freezer at the time of Blockaid's latest update, according to both reports, and The Crypto Times noted that the same governance path was apparently still open, so losses could rise further. The project had not acknowledged the breach or issued a statement through its social media channels as of Bitcoin.com's writing, according to Bitcoin.com. Holders therefore face a token whose treasury controls are still exposed to the same takeover route until the project acts.

The Senate design failed, not just the code

The transaction records point to a structural weakness rather than a coding bug in the token itself, according to The Crypto Times. Senate seats were awarded based on frozen balances at the moment of the call, so tokens bought seconds earlier carried full voting weight, and proposals could be created, approved and executed in a single transaction, leaving no window for existing holders or the team to react, according to the report. Bitcoin.com reached the same conclusion: governance lacked voting snapshots, minimum holding periods and execution delays, which let the attackers acquire voting power, approve malicious proposals and execute transactions almost immediately.

Protocols commonly guard against this pattern with voting-power snapshots taken before a proposal opens, minimum holding periods for voters, and timelocks that delay execution after a vote passes, according to The Crypto Times. Governance takeovers have become a recurring theme in 2026, according to the report, which cited Term Finance losing about $8.5 million in a governance exploit on August 23, 2026.

This article is news reporting and is not investment advice.

Sources

• Blockaid, security alerts on X (October 24, 2026) and the on-chain Etherscan transaction records cited in those alerts, primary source
• The Crypto Times, X100 Hack: Attackers Hijack Governance, Drain $4.85M as X Token Crashes 96% (October 24, 2026), secondary source
• Bitcoin.com, X 100 Global Loses Millions as Three-Seat Senate Is Hijacked (October 24, 2026), secondary source