Verify a decision

{"actor":"system:backfill","investigation_id":"7956e293-3b2e-475d-8248-060880912cb0","kind":"publish","page_slug":"x100-global","published_at":"2026-10-29T04:13:56.410Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"X100 Global","sections":[{"content":"On Saturday, October 24, 2026, an attacker used a flash loan of approximately 1.94 million USDT, reportedly borrowed from Aave, to purchase X tokens. The tokens were split across two newly deployed contracts, each staking (\"freezing\") just over 19,000 X in X100's governance system. This displaced an existing member and gave the attacker control of two of the three seats on X100's governing \"Senate,\" whose seats are allocated to the addresses holding the largest frozen balances rather than by election. According to reporting by CryptoTicker and other outlets, the protocol had no voting snapshot, minimum holding period, or execution delay between a new senator gaining voting power and that power being used, allowing the attacker to pass a malicious proposal in the same transaction sequence used to acquire the seats. The attacker's proposal directed the treasury (the \"Freezer\") to sell 400,000 X tokens into a liquidity pool the attacker had created and seeded with almost no USDT, receiving only about 35.68 USDT in return before withdrawing liquidity, selling tokens elsewhere, and repaying the flash loan, all within one block. Security firms differ slightly on the total loss: BlockSec estimated approximately $4.75 million, while Blockaid put the figure at approximately $4.85 million in USDT plus roughly 550,000 X tokens, reflecting additional follow-up transactions. Chainalysis separately reported approximately $4.7 million in stolen stablecoins. No conventional smart-contract bug or stolen private key was involved; reporting attributes the loss to the absence of governance safeguards such as timelocks and quorum requirements.","heading":"Governance Takeover and Treasury Drain (October 24, 2026)","severity":"critical","sources":[{"credibility":2,"name":"Bitcoin.com News — X100 Global Loses Millions As Three-Seat Senate Is Hijacked","type":"news_article","url":"https://news.bitcoin.com/x-100-global-loses-millions-as-three-seat-senate-is-hijacked"},{"credibility":2,"name":"CryptoTicker — X100 exploit: a flashloan bought two of three senate seats, what to check now","type":"news_article","url":"https://cryptoticker.io/en/x100-flashloan-governance-attack/"},{"credibility":2,"name":"Odaily — X100 governance exploit report","type":"news_article","url":"https://www.odaily.news/en/post/5213572"},{"credibility":2,"name":"Coinfomania — Chainalysis exposes exploit behind $4.7M stablecoin attack","type":"research","url":"https://coinfomania.com/chainalysis-exposes-exploit-behind-4-7m-stablecoin-attack/"}]},{"content":"According to Odaily's reporting, approximately 24 minutes after the first attack (at 22:11 on October 24), a second attacker independently repeated the same mechanism, using a flash loan to again seize two governance seats, removing Uniswap V3 liquidity positions held by the Freezer and extracting roughly 96,400 USDT through a self-created pool before converting proceeds to ETH and routing them through intermediary addresses toward the exchange ChangeNOW. Approximately five minutes later, a third actor reportedly exploited a lack of caller restrictions on an auxiliary contract left behind by the second attacker to pass a further proposal, moving approximately 550,000 X tokens. Coinalertnews reported that stolen funds were swapped into ETH and spread across four wallets holding roughly 400 ETH each (about 1,600 ETH total) at the time of its report. All three incidents reportedly concluded within roughly half an hour of the first transaction.","heading":"Repeat Exploits by a Second and Third Attacker","severity":"high","sources":[{"credibility":2,"name":"Odaily — X100 governance exploit report","type":"news_article","url":"https://www.odaily.news/en/post/5213572"},{"credibility":2,"name":"CoinAlertNews — X100 and Initia Exploits Drain $7.4M and Expose DeFi Security Gaps","type":"news_article","url":"https://coinalertnews.com/news/2026/10/25/x100-initia-defi-exploits"}]},{"content":"Following the exploit, the X token's market capitalization fell from approximately $760 million before the attack to approximately $24 million, a decline of more than 96% within a single day, according to Odaily's reporting citing market data. CryptoTicker separately reported the token price fell from the $50–60 range to approximately $1.75, and that decentralized exchange liquidity for the token evaporated. The scale of the pre-attack valuation is difficult to independently verify against listings on CoinMarketCap and Coinbase, which as of this investigation showed inconsistent and apparently outdated figures (e.g., a market cap of roughly $2.4 million and conflicting total-supply figures), underscoring limited and inconsistent public data coverage of the token even before the incident.","heading":"Token Price and Market Capitalization Collapse","severity":"high","sources":[{"credibility":2,"name":"Odaily — X100 governance exploit report","type":"news_article","url":"https://www.odaily.news/en/post/5213572"},{"credibility":2,"name":"CryptoTicker — X100 exploit: a flashloan bought two of three senate seats, what to check now","type":"news_article","url":"https://cryptoticker.io/en/x100-flashloan-governance-attack/"}]},{"content":"Phemex News reported, citing the blockchain security monitoring account PeckShieldAlert, that an address linked to the X100 attacker deposited 821.2 ETH (approximately $1.89 million at the time) into the Tornado Cash mixing service, a move the report characterizes as an attempt to obscure the trail of the stolen funds. This claim currently rests on a single news outlet relaying a security-monitoring account's social-media findings, with no independent confirmation found in this investigation, and should be treated as a moderately but not highly confirmed, Tier 2-sourced claim. Coinalertnews, citing Chainalysis-style on-chain tracing, separately reported that stolen stablecoins were converted to ETH and spread across four wallets holding roughly 400 ETH each, a detail that is broadly consistent with, but not identical to, the Tornado Cash figure.","heading":"Alleged Laundering of Proceeds via Tornado Cash","severity":"medium","sources":[{"credibility":2,"name":"Phemex News — X100 attacker launders 821.2 ETH via Tornado Cash after $4.75M flash loan attack","type":"news_article","url":"https://phemex.com/news/article/x100-attacker-launderes-8212-eth-via-tornado-cash-after-475m-flash-loan-attack-101141"},{"credibility":2,"name":"CoinAlertNews — X100 and Initia Exploits Drain $7.4M and Expose DeFi Security Gaps","type":"news_article","url":"https://coinalertnews.com/news/2026/10/25/x100-initia-defi-exploits"}]},{"content":"No official statement, post-mortem, or public acknowledgment from X100 Global itself was located during this investigation; multiple outlets reporting on the incident between October 24 and October 26, 2026 noted that the project had not confirmed the exploit through its own channels. Public information about X100 Global as an organization, including its founders, team, and governance design rationale, is similarly sparse: listings on CoinMarketCap, Coinbase, and FXEmpire gave inconsistent descriptions of the token (varying total-supply figures and conflicting valuation data), and no independent profile of the project's founders or operating entity could be verified through web search. This absence of verifiable identity and transparency is noted as a standalone risk factor independent of the exploit itself.","heading":"Lack of Project Transparency and Official Response","severity":"medium","sources":[{"credibility":2,"name":"CryptoTicker — X100 exploit: a flashloan bought two of three senate seats, what to check now","type":"news_article","url":"https://cryptoticker.io/en/x100-flashloan-governance-attack/"},{"credibility":2,"name":"Bitcoin.com News — X100 Global Loses Millions As Three-Seat Senate Is Hijacked","type":"news_article","url":"https://news.bitcoin.com/x-100-global-loses-millions-as-three-seat-senate-is-hijacked"}]}],"sources_used":[{"credibility":2,"name":"Bitcoin.com News — X100 Global Loses Millions As Three-Seat Senate Is Hijacked","type":"news_article","url":"https://news.bitcoin.com/x-100-global-loses-millions-as-three-seat-senate-is-hijacked"},{"credibility":2,"name":"CryptoTicker — X100 exploit: a flashloan bought two of three senate seats, what to check now","type":"news_article","url":"https://cryptoticker.io/en/x100-flashloan-governance-attack/"},{"credibility":2,"name":"Odaily — X100 governance exploit report","type":"news_article","url":"https://www.odaily.news/en/post/5213572"},{"credibility":2,"name":"Coinfomania — Chainalysis exposes exploit behind $4.7M stablecoin attack","type":"research","url":"https://coinfomania.com/chainalysis-exposes-exploit-behind-4-7m-stablecoin-attack/"},{"credibility":2,"name":"CoinAlertNews — X100 and Initia Exploits Drain $7.4M and Expose DeFi Security Gaps","type":"news_article","url":"https://coinalertnews.com/news/2026/10/25/x100-initia-defi-exploits"},{"credibility":2,"name":"Phemex News — X100 attacker launders 821.2 ETH via Tornado Cash after $4.75M flash loan attack","type":"news_article","url":"https://phemex.com/news/article/x100-attacker-launderes-8212-eth-via-tornado-cash-after-475m-flash-loan-attack-101141"}],"summary":"X100 Global is an Ethereum-based project whose governance system, a three-seat \"Senate\" controlling a treasury called the \"Freezer,\" was exploited on October 24, 2026. An attacker used an Aave flash loan to buy enough X tokens to seize two of three Senate seats and pass a treasury-draining proposal in a single transaction; two further attackers repeated or extended the exploit within roughly 30 minutes. Reported losses range from about $4.75 million to $4.85 million, the X token's market capitalization fell from roughly $760 million to about $24 million in one day, and part of the proceeds was reportedly routed through the Tornado Cash mixer. No official project background, team identification, or public post-mortem from X100 Global was found during this investigation.","timeline":[{"date":"2026-10-24","date_evidence":"on Saturday, October 24, 2026, and emptied its treasury","event":"An attacker used an Aave flash loan (~1.94M USDT) to buy X tokens, split them across two contracts to seize two of three X100 Senate seats, and passed a proposal draining 400,000 X from the treasury into a self-created, near-empty liquidity pool.","source":"Bitcoin.com News / Odaily","source_url":"https://news.bitcoin.com/x-100-global-loses-millions-as-three-seat-senate-is-hijacked"},{"date":"2026-10","date_evidence":"At 22:11 on October 24, the hacker borrowed approximately 1.94 million USDT via an Aave flash loan","date_original":"2026-10-24","event":"First attack transaction executed at 22:11 (reported local/source time), beginning the flash-loan governance takeover.","source":"Odaily","source_url":"https://www.odaily.news/en/post/5213572"},{"date":"2026-10","date_evidence":"About 24 minutes after the first attack, a second hacker again seized two governance seats via flash loan","date_original":"2026-10-24","event":"A second attacker repeated the exploit roughly 24 minutes after the first, seizing two Senate seats and extracting approximately 96,400 USDT and additional assets.","source":"Odaily","source_url":"https://www.odaily.news/en/post/5213572"},{"date":"2026-10","date_original":"2026-10-24","event":"A third actor, within about five minutes of the second attack, exploited an unrestricted auxiliary contract to pass a further proposal moving approximately 550,000 X tokens.","source":"CCN / Odaily reporting","source_url":"https://www.odaily.news/en/post/5213572"},{"date":"2026-10","date_original":"2026-10-25","event":"Chainalysis publicly reported the exploit, estimating approximately $4.7 million in stolen stablecoins; coverage noted roughly 560,000 X tokens remained unsold in attacker-controlled addresses and proceeds were split across four ETH wallets.","source":"Coinfomania / CoinAlertNews","source_url":"https://coinfomania.com/chainalysis-exposes-exploit-behind-4-7m-stablecoin-attack/"},{"date":"2026-10-26","date_evidence":"Phemex News 2026/10/26 15:24","event":"Phemex News reported, citing PeckShieldAlert, that an address linked to the X100 attacker had deposited 821.2 ETH (~$1.89 million) into Tornado Cash.","source":"Phemex News","source_url":"https://phemex.com/news/article/x100-attacker-launderes-8212-eth-via-tornado-cash-after-475m-flash-loan-attack-101141"}]},"v":1}