Attackers hijack two of three 'Senate' seats at Ethereum project X 100 Global with a flash loan and drain $4.85 million in USDT as its token falls 96 percent

An Ethereum project called X 100 Global lost about $4.85 million on Saturday after attackers seized control of its governance rather than breaking its code. Blockaid first warned that an attack was under way, and The Defiant reported that two transactions turned treasury tokens and liquidity positions into about 4.85 million USDT.

Bitcoin.com News, citing Blockaid and the security firm Exvul, described how it worked. The project's treasury is run by a three-seat "Senate". The attackers borrowed about 1.94 million USDT in an Aave flash loan, used it to buy X tokens, and registered helper contracts to occupy two of the three seats. Because the governance system had no voting snapshots, no minimum holding periods and no execution delays, they could pass and execute proposals almost at once. One transaction moved 400,000 X tokens from the project's "Freezer" treasury into a liquidity pool the attackers controlled; the tokens were then sold through a Uniswap V3 pool. About 550,000 X tokens were taken across three transactions, with about 12.2 million still in the Freezer when Blockaid last reported, per Bitcoin.com News.

The X token collapsed from the $50 to $60 range to about $1.75. As of Saturday afternoon the project had not acknowledged the breach on its channels, Bitcoin.com News said, and the incident was still described as ongoing. What comes next depends on whether the remaining tokens in the Freezer can be protected and whether any of the USDT can be frozen; a treasury is only as safe as the rules for voting on it.