Originally published at panda-security.xyz

On 24 October 2026 at 14:11:47 UTC , a single Ethereum transaction turned a flash loan into a governance majority at X100 , then used that majority to make the project's own treasury sell 400,000 X for roughly 36 USDT . The attacker walked away with about 4.75 million USDT from that one transaction. Follow-on transactions using the same path pushed the total realized to roughly $4.85M , according to Blockaid.

Nothing here required a stolen key or a compiler bug. The governance system did exactly what it was written to do. It just measured voting power at the one moment an attacker could rent it.

TL;DR

Protocol: X100, an ERC-20 token project (ticker X ) whose "Senate" decides where the project's liquidity sits.

Chain: Ethereum mainnet.

Loss: 361,799.999998 X left the Freezer/DexTreasury in the main transaction; the attacker realized about 4.75M USDT.…