X100 Exploit Realises $4.85m, Blockaid Says

An exploit at X100, a token project on Ethereum, has realised about 4.85 million USDT for the attackers so far, according to the blockchain security firm Blockaid, which says the attack is still under way. The figures below may change as it continues.

“Blockaid detected an ongoing exploit on X100 on Ethereum,” the firm posted on X at 14:49 UTC (15:49 BST) on Saturday 24 October. “An attacker seized two of three Senate seats and sold 400,000 X from the treasury into an empty pool they created. A second attacker later burned the Freezer’s Uniswap V3 positions. ~$4.85M USDT realized so far across 2 txs. Attack still ongoing.”

About 20 minutes later, Blockaid posted an update. “Update: a third attacker used the same Senate path and pulled the remaining ~550,000 X Uniswap V3 LP,” it wrote. “~$4.85M USDT realized plus ~550k X extracted across 3 txs. ~12.2M X still in the Freezer. Attack still ongoing.” That update, timed at 15:10 UTC (16:10 BST), carries the latest figures TSN has seen. Details are via @blockaid_ on X.

In brief

What happened: Blockaid says attackers who took control of X100’s governance seats have realised about 4.85 million USDT and extracted about 550,000 X tokens across three transactions.
Why it matters: Blockaid says about 12.2 million X remain in the project’s Freezer contract while the attack continues.
What’s unknown: the final loss, whether X100 can stop further transfers, and what the project itself says. No statement had appeared on its X account by 16:50 BST.

Etherscan shows the moves began before Blockaid’s alert

Blockaid published Etherscan links alongside its posts, which give a second, on-chain record of the incident. Its example exploit transaction is recorded on Etherscan as a successful Uniswap V3 swap at 14:11 UTC. The third transaction, also on Etherscan, succeeded at 14:40 UTC and is recorded as removing 549,999.4 X and 30.69 USDT of liquidity from Uniswap V3. Both came before Blockaid’s first public alert.

The Defiant, citing Blockaid and onchain records, reported that a different sender was behind the third transaction, routing about 549,916 X and 1,909 USDT to a new beneficiary while the affected pool held less than 200 USDT. Its first report said two transactions had turned treasury tokens and liquidity positions into USDT. TechFlow carried the same figures, crediting Blockaid. The small gaps between these numbers have not been explained.

The X token’s price, as shown on Etherscan’s token page, stood at about $50.74 at 14:49 UTC and about $1.76 an hour later. Etherscan’s figure for a token with fewer than 200 holders may not reflect a price anyone could trade at, so treat it as a rough signal.

X100 put its liquidity in the hands of a Senate

X100 describes its design in its own posts on X. The project says it has a fixed supply of 14 million tokens and that its tokens are “held in smart contracts, with liquidity decisions made by the Senate”, according to a 16 October post. An earlier post said Senate decisions “need 2/3 support”.

Blockaid’s posts say the attackers held two of three Senate seats. The contract Blockaid identified as the victim, the Freezer contract, still held about 12.2 million X at the time of its 15:10 UTC update, by Blockaid’s count. X100’s account had posted nothing about the incident by 16:50 BST. Its most recent post was on 21 October.

Holder-run treasuries turn a few seats into the keys

This is TSN’s analysis. X100 pitched its Senate as a way for holders to share control of the project’s liquidity, which the team says is held in smart contracts rather than by the team. That design moves the security question from a single private key to a small group of governance seats. When a two-thirds vote can release treasury tokens, controlling two of three seats is effectively the same as holding the keys. Blockaid’s description of a third attacker using “the same Senate path” suggests the weakness stayed open while the money was moving.

For anyone working in compliance, the timeline is the familiar problem. The on-chain records show transactions at 14:11 and 14:40 UTC, before a public alert at 14:49 UTC. That fits Blockaid’s own research on how fast stolen funds move, which put the median at 17 minutes. Screening teams watching addresses linked to the exploit will need to update their lists as Blockaid adds them, because the incident has already involved more than one sender.

Holders should treat every figure here as provisional. The total realised so far, the 550,000 X removed and the 12.2 million X left in the Freezer all come from a firm watching an attack that, by its account, had not ended.

TSN has covered recent incidents in which a single weak point exposed users’ funds, including the unauthorised mint that halted Cysic’s bridge and the Fearless Wallet extension key leak. TSN tracks crypto crime and enforcement cases on its Crypto Hacks and Exploits hub. This story will be updated as figures change.