Governance Exploit Drains $485K from Ethereum's X100 Protocol
A decentralized finance protocol on Ethereum, X100, is currently under an active exploit. Security analytics firm Blockaid reported the ongoing attack on October 24th, noting that by the time of their alert, approximately $485,000 worth of USDT had already been siphoned off in two separate transactions.
How the Attack Unfolded: A Takeover of Governance
This was not a typical smart contract bug exploit. The attack vector centered on the protocol's governance mechanism. The attacker managed to seize control of two out of three key governance seats, effectively gaining administrative power over the protocol's treasury and core functions.
With this control, the attacker executed a two-step financial drain:
- Treasury Dump: 400,000 of the protocol's native tokens (X tokens) were withdrawn from the community treasury.
- Fake Pool Creation: These tokens were then sold into a shallow, newly created liquidity pool set up by the attacker themselves, converting them into stablecoins.
Second Phase: Liquidity Positions Destroyed
Following the initial fund extraction, a subsequent action—potentially by the same actor—targeted the protocol's liquidity. The attacker accessed a contract termed “Freezer,” which held the protocol's Uniswap V3 liquidity positions (LP), and proceeded to destroy them. This move crippled the protocol's trading infrastructure and could precipitate wider financial instability for its users.
Blockaid has publicly shared the attacker's wallet addresses and sample transaction hashes to aid in tracking and potential fund recovery. This incident serves as a stark reminder that in DeFi, decentralized governance can itself become a critical vulnerability. Robust security must extend beyond code audits to include rigorous safeguards for governance keys, multi-signature schemes, and privilege escalation processes.