X100 stablecoin exploit drains $4.7M after attackers seize protocol votes

Attackers took control of protocol voting before draining approximately $4.7 million in stablecoins in the X100 stablecoin exploit, Chainalysis reported. By capturing Senate seats, they secured a majority that allowed them to manipulate treasury assets and direct them into a pool they controlled.

Key takeaways

• The X100 attack used governance control to reach treasury assets.
• Stolen funds were converted into ETH and divided among four wallets.
• Attackers still held roughly 560,000 unsold X tokens.

How the X100 stablecoin exploit reached the treasury

Contracts used in the attack captured protocol Senate seats, giving the attackers a voting majority, according to Chainalysis. That control enabled the manipulation of treasury assets.

The Freezer treasury was forced to sell assets into an attacker-controlled pool. The reported sequence connects the governance takeover directly to the movement of funds: control over voting gave the attackers the means to redirect treasury assets.

After extraction, the stolen funds were exchanged for ETH. Chainalysis traced their distribution to four wallets, each holding 400 ETH.

Governance weaknesses extend beyond the stolen funds

The X100 stablecoin exploit exposed severe weaknesses in decentralized governance, with the attackers using majority control to manipulate the treasury. The security failure involved both the protocol’s voting structure and the assets that structure governed.

The incident raises concerns about decentralized finance security and the integrity of systems that place treasury decisions under protocol governance. In this case, capturing Senate seats provided the control needed to force asset sales into an attacker-controlled pool.

Mixed market signals and stronger protocol security

The broader market showed mixed signals around the incident, with some assets holding up while others faced downward pressure. The reported market picture does not establish a uniform response to the attack.

The governance manipulation highlights the need for stronger security measures across blockchain protocols. The attack’s path—from Senate-seat capture to treasury manipulation—puts governance protection alongside fund protection at the center of the security concerns.

Chainalysis also identified a remaining token balance: approximately 560,000 X tokens were still unsold at attacker-controlled addresses.

Article produced with the assistance of artificial intelligence and reviewed by the editorial team.