{
  "id": 16388863,
  "title": "X100 Exploit: A Flash-Loaned Senate Drained $4.75M",
  "url": "https://urgent.news/2026/10/24/x100-exploit-a-flash-loaned-senate-drained-4-75m",
  "topic": "world",
  "section": "World",
  "published": "2026-10-24T23:12:57.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/pandasecurity/x100-exploit-a-flash-loaned-senate-drained-475m-hfi"
  },
  "original_language": "en",
  "account": "On 24 October 2026, a single Ethereum transaction exploited a weakness in X100's governance system to drain $4.75 million worth of the project's treasury. The attack took advantage of three design flaws in the protocol: instant, permissionless Senate entry, seats ranked by live balances, and the ability to propose, vote, and execute in the same transaction without any delay.\n\nX100 is an ERC-20 token project whose Senate decides where the project's liquidity sits. Holders lock (freeze) their X tokens in a contract called the Freezer, and the three largest frozen positions among Senate applicants hold the three seats. In this case, the seats were held by stakeholders with 20,500 X, 19,000 X, and 1,000 X.\n\nThe attacker rented a seat by paying a 100 X fee and froze 19,000.000001 X, just one millionth of a token more than the current largest frozen position. Using a flash loan, the attacker purchased roughly 38,200 X from Uniswap V3 and used that X to pass a proposal calling the Freezer's v3Swap function, which swapped 400,000 X to a pool the attacker had created earlier. The treasury sold the X at a loss, realizing about $4.75 million in USDT.",
  "summary": "Originally published at panda-security.xyz On 24 October 2026 at 14:11:47 UTC , a single Ethereum transaction turned a flash loan into a governance majority at X100 , then used that majority to make the project's own treasury sell 400,000 X for roughly 36 USDT . The attacker walked away with about 4.75 million USDT from that one transaction. Follow-on transactions using the same path pushed the…",
  "key_points": [
    "On 24 October 2026, a Flash-Loaned Senate drained $4.75M from X100 treasury",
    "Attacker froze 19,000.000001 X, purchased 38,200 X from Uniswap V3 for proposal execution"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}