An attacker took control of X100's on-chain governance and emptied a large share of its treasury in a single transaction on October 24, 2026, according to a CryptoSlate report citing on-chain data reconciled by Bitquery. The approximate loss was $6 million. The method did not rely on a broken cryptographic primitive or a leaked key. It used the governance rules exactly as written.
X100 routes treasury decisions through a body it calls the Senate. Eligibility to sit in the Senate depends on how many X tokens an address has frozen in the project's Freezer contract. Lock terms run from one to five years, but seat eligibility counts only the amount currently frozen, with no minimum stake age. That last detail is the opening. An address that froze tokens one second ago carried the same weight as one that had committed capital for years.
A treasury emptied in one block
The attacker deployed two helper contracts. Each froze 19,000.000001 X tokens under one-year terms, registered as candidates, entered the Senate ranking, and cast two supporting votes. With those votes, the contracts executed proposal 7. All of it happened inside one transaction.
The flaw sat in the execution rule. While a proposal stayed open, a majority of the currently ranked Senate seats could authorize it to run. The attacker held two of the three ranked seats, so a majority was immediate and the waiting period was zero. Proposal 7 approved a swap that pushed 400,000 treasury X into a pool the attacker had created, returning just 35.675313 USDT to the treasury. The treasury handed over its tokens and received almost nothing back.
A flash loan that repaid itself
Funding for the setup came from a flash loan of about 1.94 million USDT. Normally a flash loan has to be repaid inside the same transaction, which forces the borrower to unwind every position before the block closes. Here the attacker did not need to. The frozen stake stayed locked the entire time. Cash pulled from the treasury and from selling the drained X covered the principal and the premium, so the loan closed out on its own proceeds without touching the staked position.
Bitquery's reconciliation traced 4.848 million USDT paid out to three selected recipients. That figure excludes the X tokens the attacker had not yet sold, which is why the headline loss lands near $6 million rather than the reconciled cash total.
A near-identical playbook at Arkadiko
Two days before the X100 drain, the lending protocol Arkadiko lost about $1.09 million to the same structural weakness. The stolen value broke down to roughly $780,000 of stSTX, $135,000 of sBTC, and $173,000 of STX, raised by selling unbacked USDA.
Arkadiko's proposal 12 ran from October 17 to 22, a five-day window. Voting power, though, could be bought while the ballot was still open. One wallet swapped into roughly 4.573 million DIKO at 15:03:46 UTC and voted three minutes later, at 15:06:47 UTC on October 22. The malicious contract behind the proposal lacked caller authorization on its withdrawal and USDA-minting functions, and it executed the moment the ballot closed with no separate delay. On October 27 at 07:57 UTC, Arkadiko passed proposal 14, labeled AIP 32.2, to restore vault operations to its legitimate v1-3 contract.
The missing guardrail is time
Both attacks share one root cause. Governance let an address acquire voting power during an open vote and act on it instantly. There was no gap between a proposal passing and a proposal running, and no check that the voters backing it had held their stake before the proposal existed. A timelock, a snapshot of eligible voters taken before voting opens, or a minimum stake age would each have broken the sequence.
For anyone holding governance tokens or parking assets in a protocol treasury, the takeaway is concrete. A token balance is not the same as control of the contract that holds the money. Governance design is part of the attack surface, and a protocol that can be voted into draining itself in one block is a counterparty risk regardless of its audit history. Keeping funds you are not actively deploying in a wallet you control, rather than inside a governed contract, limits exposure to this class of failure.
Overview
X100 lost about $6 million on October 24, 2026 after an attacker froze tokens, seized two of three Senate seats, and passed a proposal that swapped 400,000 treasury X for 35.675313 USDT, all in one transaction funded by a self-repaying 1.94 million USDT flash loan. Days earlier, Arkadiko lost about $1.09 million to the same flaw: voting power bought mid-ballot and executed with no delay. Both failures trace to governance that allowed instant action without an execution timelock or a voter snapshot.
