X100 Global Faces About $4.75 Million in Ethereum-Linked Losses

BlockSec flagged a suspected Ethereum governance attack at X100 Global, estimating losses at about $4.75 million after an attacker gained majority control of its three-seat governing body.

The attacker borrowed funds through a flash loan, bought X tokens, split them between two controlled contracts and deposited them into Freezer. That gave the attacker two of the three senator seats, allowing a treasury proposal to pass and execute in the same transaction.

The attacker first created liquidity in PancakeSwap V3’s X-USDT pool. The proposal then approved swapping 400,000 X tokens into that pool with the minimum output set at zero. The trade returned about 35.68 USDT. The attacker later withdrew liquidity, sold some recovered X through an existing Uniswap V3 X-USDT pool and repaid the flash loan.

The reported activity involved two X-USDT pools on Ethereum, one on PancakeSwap V3 and one on Uniswap V3. The specific proposal swap returned about 35.68 USDT, while BlockSec’s estimated total loss was about $4.75 million.