Back Kucoin

X100 Global Suspected Governance Attack Steals $4.75M Through Exploited Vulnerability

Kucoin • October 25, 2026

Huo Xing Finance reports, according to BlockSec monitoring, a suspicious transaction on Ethereum by X100 Global resulted in approximately $4.75 million in losses. The attack stemmed from a vulnerability in the governance mechanism design: the attacker used a flash loan to borrow funds, purchased X tokens, and allocated them to two controlled contracts, then deposited them into the Freezer, thereby gaining control of two out of three senator seats within a single transaction. The attacker immediately proposed and executed a malicious treasury proposal. Specifically, the attacker first created liquidity and added it to the X-USDT trading pool on PancakeSwap V3, then used their gained majority governance voting power to approve the exchange of 400,000 X tokens into this trading pool with a minimum output set to 0, ultimately receiving only 35.68 USDT. Subsequently, the attacker withdrew liquidity, sold a portion of the recovered X tokens via the existing Uniswap V3 X-USDT trading pool, and repaid the flash loan.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

X100 Governance Exploit Drains $4.85M from Treasury On October 24, 2026, the X100 protocol suffered a governance exploit that allowed an attacker to seize control of its treasury and liquidate assets worth $4.85 million in USDT. The exploit did not involve a smart contract vulnerability but rather exploited governance mechanisms, enabling the attacker to pass a malicious proposal with likely compromised keys or a low-quorum vote. The attacker converted treasury tokens and liquidity positions into USDT and withdrew 550,000 X tokens from a Uniswap pool. This incident highlights significant vulnerabilities in decentralized finance governance and treasury management practices. As of October 25, 2026, the situation remains under close observation as the implications for other decentralized organizations are assessed. 7 sources 69

Extracted Entities

X100 Global Suspected Governance Attack Steals $4.75M Through Exploited Vulnerability

The full story

Extracted Entities

Attack Types (1)

Companies (2)

Platforms (1)