Hackers Drained $4.85M From X100 in Two Transactions — and the Attack Was Still Live
While Blockaid's security alerts were still firing, attackers had already converted X100's entire treasury into 4.85 million USDT and walked out the door.
This wasn't a slow bleed. Two transactions. That's all it took. The exploit targeted X100 on Ethereum through a governance takeover, giving the attacker the keys to the kingdom before anyone could pull an emergency brake. Treasury tokens and liquidity positions were swept clean and flipped into USDT with surgical precision.
How a Governance Takeover Becomes a Heist
Governance exploits are the quiet terror of DeFi. Unlike flash loan attacks or bridge vulnerabilities, they don't require breaking the code. They require breaking the rules of the game itself. An attacker accumulates or hijacks enough voting power to pass a malicious proposal, and suddenly the protocol's own smart contracts are working against it.
That appears to be exactly what happened here. Once control was secured, the attacker didn't need to brute force anything. The treasury and liquidity positions were effectively handed over by the protocol's own governance layer.
Blockaid flagged the Ethereum-based attack as ongoing, which means the warning came while the exploit was still in motion. That's a chilling detail. Security infrastructure caught it in real time, but real time wasn't fast enough to stop the drain.
$4.85M in USDT Means This Is Already Gone
The conversion to USDT is the detail that matters most to recovery prospects. Stablecoins can move fast, bridge fast, and mix fast. Unlike holding a volatile governance token that might be traceable or freezable, USDT in the hands of a sophisticated attacker is one Tornado Cash session or cross-chain bridge away from being untraceable.
Blockchain investigators will be watching wallet activity closely, and Tether does have the technical ability to freeze USDT in specific addresses if law enforcement or a legal order is involved. But that window closes quickly.
What DeFi Holders Should Watch Right Now
This attack is a direct signal to anyone holding funds in protocols with on-chain governance, especially smaller DeFi projects where governance token distribution is concentrated or poorly guarded.
Three things to do right now:
- Check your exposure. If you are providing liquidity or holding governance tokens in any smaller DeFi protocol, audit who controls the voting power. - Watch Blockaid and DeFi security feeds. This exploit was flagged in real time. Following security infrastructure accounts gives you a head start. - Treat low-liquidity governance tokens as high risk. If a protocol can be taken over with a concentrated token position, your funds inside it are only as safe as its weakest voter.
Governance is DeFi's most underrated attack surface. X100 just became the latest proof.