The X100 Exploiter Is Moving Fast, and the Pattern Is a Red Flag

An attacker who drained X100 just converted approximately 4.75 million USDT into Ethereum and split the proceeds across four separate 400-ETH wallets, while a distribution wallet quietly held onto another 423 ETH.

This is not random. This is a laundering playbook.

Why Four Wallets?

Splitting stolen funds into near-identical chunks is a classic obfuscation technique. Smaller, uniform wallet balances are harder to flag automatically, harder to freeze, and easier to route through mixers or bridging protocols without triggering exchange compliance filters.

The 423 ETH sitting in the distribution wallet suggests the operation is still live. That ETH has not moved yet, which means whoever is behind this is either waiting for heat to die down or staging the next phase of dispersal.

What We Know Right Now

- ~4.75 million USDT was swapped into ETH shortly after the exploit - Four wallets each received approximately 400 ETH - 423 ETH remains in the distribution wallet as of the latest on-chain data - The total exposure represents a significant liquidity event for a protocol that was not on most traders' radars

The USDT-to-ETH swap is also deliberate. Tether has the ability to blacklist USDT addresses linked to exploits, and that power has been used before. Converting to ETH removes that single point of failure for the attacker. ETH cannot be frozen at the asset level.

The Bigger Problem

X100 is not the headline story here. The story is how quickly and cleanly this attacker moved. From exploit to structured dispersal in what appears to be a compressed timeframe, this has the fingerprints of someone who has done this before or followed a well-documented script.

DeFi security firm watchers have flagged this wallet cluster, but flagging is not stopping. Until centralized off-ramps coordinate faster with on-chain forensic teams, split-wallet exits like this one remain a reliable escape route.

What to Watch

If you are holding assets in any smaller DeFi protocol right now, this is your reminder to check audit history and TVL concentration. Protocols with shallow liquidity and unaudited contracts remain the easiest targets.

Watch the four 400-ETH wallets. If they start bridging to Arbitrum, Optimism, or through a privacy protocol like Railgun, that signals the attacker is moving toward an exit. Any significant ETH movement from the 423-ETH distribution wallet is the next on-chain event worth tracking in real time.

The funds are not gone yet. But the window to trace them is closing fast.