X100: A $1.94M Loan Bought Its 'Senate' for One Transaction, and the Senate Voted Away $4.85M

At 14:11:47 UTC on Saturday 24 October 2026, a single Ethereum transaction did something that would take a corporate raider months and a team of lawyers. It borrowed $1.94 million, used the money to win two of the three seats on a crypto project's governing "Senate", passed a motion telling the project's treasury to sell its own tokens for almost nothing, collected the proceeds, and paid the loan back. The whole sequence took one block, about twelve seconds.

The project was X100, also called X 100 Global, a small Ethereum token project, on X since August 2026, whose ticker on the blockchain is simply X. It has nothing to do with Elon Musk's social network. X100 sold itself as a token for everyday spending, "Staking. Trading. Gaming. Travel." in the words of its own profile on X, with a fixed supply of 14 million tokens and, its central promise, no team control over the money.

By the time the dust settled the attackers had walked off with about $4.85 million in USDT, a stablecoin, which is a digital dollar issued by the company Tether, plus around 550,000 more X tokens, according to the security firm Blockaid. The X token fell from roughly $50 to $60 to $1.78 on Etherscan's market data that evening, a drop of 96.5%. Etherscan listed 202 holders. Two days later, 821.2 ether worth about $1.89 million went into Tornado Cash.

The board that anyone could rent

X100 spent September and October telling the public it had solved rug pulls, the crypto scam in which founders run off with the money. "Tired of rug pulls? So are we," it posted on 30 September. The fix was the Senate. Holders "freeze" their X tokens in a contract called the Freezer for one, three or five years in return for rewards, much like locking shares in a long-term savings scheme. The holders with the biggest frozen stakes who had applied for a seat sat in the Senate, and the Senate decided what happened to the project's treasury. "The team can't withdraw the treasury to its own wallet," X100 posted on 29 September. On 12 October it pitched the Senate as up to 21 holders, with decisions needing two thirds support.

On the day of the attack the Senate had three members. According to an analysis of the contract's ranking records by Coindaro, cited by the security researchers PandaSecurity, the seats were held by stakes of 20,500, 19,000 and 1,000 X tokens. At around $50 a token, roughly $2 million of frozen stake was guarding a treasury that still held 12.2 million X after the attack.

Three design choices made those seats for sale. Anyone could apply for the Senate on the spot for a fee of 100 X. Seats went to whoever had the most tokens frozen at that very moment, with no snapshot taken earlier and no rule that the tokens had to have been held for any time at all. And a proposal could be written, voted on and carried out instantly, with no timelock, the waiting period that most governance systems put between a vote and its execution so that others can react. In stock-market terms, it was a company whose board seats went to whoever held the most shares at the moment of the vote, where shares bought one minute earlier counted in full, and where the board's decisions were wired straight to the bank account.

How one transaction did it

The attacker's tool was a flash loan. Aave, one of the largest lending services in crypto, will lend almost any amount with no collateral and no credit check, on one condition: the money must be paid back inside the same transaction. If it is not, the whole transaction is cancelled as though it never happened. It is a loan that lasts seconds, and it costs only a small fee.

According to the transaction records described by the security firms ExVul and BlockSec, the attacker borrowed 1,942,457.64 USDT from Aave and used it to buy 38,200 X on Uniswap, a large automated exchange. Two freshly created helper contracts each froze 19,000.000001 X. That was enough to beat the incumbent senator holding 19,000 X by the smallest fraction the contract could count. Each helper paid its 100 X entry fee and took a seat. Two of three seats meant a majority.

Proposal number 7 went in next. Its proposer's vote counted automatically, the second helper voted yes, and the contract executed it straight away. The proposal ordered the Freezer to sell 400,000 X into a trading pool on PancakeSwap, another automated exchange, with the minimum acceptable price set to zero. The attacker had created that pool moments earlier in the same transaction and was its only supplier. The treasury received 35.68 USDT for 400,000 tokens. Crypto Times, reading the event log, reported that the proposal's description read "testnet flash governance proof".

The attacker then pulled the tokens back out of the pool, sold 131,702.92 X into the genuine Uniswap market for about 6.69 million USDT, repaid Aave and sent 4,749,726.10 USDT to his own address, keeping about 268,000 X on top. The one cost he could not recover was the 38,000 X his helpers had frozen for a year, bought with the borrowed money.

The door stayed open

The flaw was not fixed by the first raid. At 14:40:47 UTC, half an hour later, a second address used the same route. Two newly seated senators passed a series of proposals that emptied the Freezer's own trading position on Uniswap, removing 549,999.4 X and 30.69 USDT and burning the record of the position. Blockaid treated it as a second attacker and posted its alert at 14:49 UTC, warning that the attack was still going on. As of 25 October two Senate seats were still held by attacker contracts, according to Bitcoin.com News, and 12.2 million X remained in the Freezer, worth a fraction of what it had been that morning.

The headline numbers differ, and the difference is mostly about what is counted. BlockSec, ExVul and PeckShield put the loss at about $4.75 million, which is the cash from the first transaction alone. Blockaid's figure of $4.85 million in USDT adds the follow-up transactions, and the blockchain data firm Bitquery traced 4.848 million USDT paid to three recipients. Chainalysis estimated about $4.7 million in stablecoins across three transactions. CryptoSlate's $6 million headline also values the X tokens the attackers had not yet sold, tokens that lost 96% of their value in the crash the attack itself caused. The realised loss in dollars is about $4.85 million.

Into the mixer

The attackers converted their dollars into ether and spread it across wallets. Chainalysis traced four wallets holding 400 ether each. On 26 October the tracking account TraceFast watched a distributor wallet send 420.8 ether into Tornado Cash in 42 deposits of 10 ether and eight of 0.1 ether, followed by 400.4 ether from the first of the four wallets. Tornado Cash is a mixer: a pool where thousands of users deposit identical amounts and withdraw them to fresh addresses, so that the link between who put money in and who took it out is lost. PeckShield confirmed the total at 821.2 ether, about $1.89 million, at 14:53 UTC that day. Three wallets still held about 400.5 ether each, roughly $2.8 million between them.

Nobody has been named. The attackers' addresses are public, including 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63, the one ExVul labelled as the main attacker, and no law enforcement agency has said it is involved.