X100 Senate treasury hack — October 2026

X100 is an Ethereum token project whose treasury is run by a three-seat “Senate”, with seats held by whoever has frozen the most X tokens. At 14:11:47 UTC on 24 October 2026 an attacker flash-borrowed about 1.94 million USDT from Aave, bought 38,200 X and froze it through two helper contracts, winning two of the three seats by a margin of about one millionth of a token. Because seats were counted on live balances and proposals could be made, voted on and executed in the same transaction, the attacker then passed a proposal that made the treasury sell 400,000 X into a pool the attacker had just created, for about $35.68.

The attacker sold the X back into X100’s main Uniswap pool and repaid the loan. This registry read the transaction receipt: the pool lost 4,750,733 USDT, and the attacker kept 4,749,726 USDT after the flash-loan fee. According to Bitquery, most of that USDT had been put into the pool minutes earlier by Senate members buying X. A second wallet used the same open door 24 minutes later and withdrew treasury liquidity positions; CertiK puts the pool’s total net USDT outflow across the transactions at 4,849,157 USDT, the headline here, with the first transaction alone as the lower figure. CertiK notes that different wallets do not prove different people.

The first attacker’s funds were swapped to 2,022.86 ETH. X100 had published no statement by 28 October, and nothing has been reported as returned.