According to Chainalysis, in the X100 stablecoin vulnerability incident, the attacker first gained control of the protocol's voting power, then transferred approximately $4.7 million in stablecoins.
By seizing Senate seats, the attacker gained a majority vote, enabling them to manipulate treasury assets and transfer those assets into a pool under their control.
How the X100 stablecoin vulnerability affected the treasury
According to Chainalysis, the contract used in the attack seized a seat on the protocol's Senate, giving the attacker a voting majority. This control allowed them to manipulate the treasury assets.
The Freeze Vault was forced to sell its assets into a liquidity pool controlled by the attacker. The fund flow sequence in the report directly links the governance takeover with the asset transfer: control over voting rights enabled the attacker to redirect the vault's assets.
After the withdrawal, the stolen funds were converted into ETH. Chainalysis traced the funds to four wallets, each holding 400 ETH.
Governance weaknesses are not limited to stolen funds.
The X100 stablecoin vulnerability exposed a critical weakness in decentralized governance, as attackers exploited majority control to manipulate the treasury. This security failure involved both the protocol’s voting structure and the assets it governs.
This incident has raised external concerns about the security of decentralized finance and the integrity of entrusting treasury decisions to protocol governance systems. In this event, gaining control of Senate seats provided the necessary authority to force the sale of assets into a liquidity pool controlled by the attacker.
Chainalysis also noted that approximately 560,000 X tokens remain unsold in the attacker's addresses.
The article was generated with the assistance of artificial intelligence and reviewed by the editorial team.