X100.world exploited for $4.75M via flash-loan-enabled same-block governance capture and treasury drain.
Security & Exploits ·
X100.world suffered a loss of approximately $4.75 million on October 24, 2026, in an attack that exploited governance mechanics and flash lending. The X token was trading at $50.74 at the time. The attacker used a flash-borrowed ~1.94 million USDT to acquire ~38.2K X tokens, then distributed these across helper contracts to rapidly accumulate voting power in the protocol's "Senate" governance structure. Because Senate membership was determined by current frozen token stake with no snapshot or timelock protections, the attacker gained majority control in the same transaction.
The vulnerability lay in the Senate and DexTreasury contract design, which permitted proposals to execute treasury functions immediately. The attacker proposed and passed a governance action that invoked the treasury's v3Swap function to move the protocol's X holdings into a freshly created, attacker-controlled liquidity pool at a manipulated price. The attacker then withdrew the liquidity, sold approximately 400K X on the main pool, and repaid the flash loan while retaining the profits.
The treasury was drained of ~361.8K X, representing the bulk of the $4.75M loss. The attack highlights how combining flash loans, governance capture, and price manipulation via isolated liquidity pools can bypass protections that assume multi-block execution or distributed stakeholder verification.