X100 Global Suspected Governance Attack Steals $4.75M Through Exploited Vulnerability

Huo Xing Finance reports, according to BlockSec monitoring, a suspicious transaction on Ethereum by X100 Global resulted in approximately $4.75 million in losses. The attack stemmed from a vulnerability in the governance mechanism design: the attacker used a flash loan to borrow funds, purchased X tokens, and allocated them to two controlled contracts, then deposited them into the Freezer, thereby gaining control of two out of three senator seats within a single transaction. The attacker immediately proposed and executed a malicious treasury proposal. Specifically, the attacker first created liquidity and added it to the X-USDT trading pool on PancakeSwap V3, then used their gained majority governance voting power to approve the exchange of 400,000 X tokens into this trading pool with a minimum output set to 0, ultimately receiving only about 35.68 USDT. Subsequently, the attacker withdrew liquidity, sold a portion of the recovered X tokens via the existing Uniswap V3 X-USDT trading pool, and repaid the flash loan.