X100’s $4.85M Exploit: The Vote Was the Exit.

At 14:11:47 UTC on October 24, the X100 governance exploit turned a treasury decision into a payout within one Ethereum transaction. X100’s Freezer sent 400,000 $X to a newly created pool. It received 35.675313 Tether ($USDT) in return.

That exchange was not the final profit. The same transaction sold tokens into a different pool, repaid a flash loan and sent 4,749,726.096973 USDT to the initiating wallet. The public receipt makes the sequence visible.

For holders, the uncomfortable question is straightforward: who can authorize a trade with the treasury’s assets, and how much freedom does that authorization give them?

How the X100 governance exploit used two seats

Blockaid’s October 24 disclosure said an attacker seized two of X100’s three Senate seats, sold treasury tokens into an attacker-created pool, and was followed by another attacker who removed the Freezer’s Uniswap V3 positions. It reported approximately 4.85 million USDT realized across two transactions.

The security firm later reported a third extraction involving roughly 550,000 X. Those tokens are not another 550,000 dollars. Their realizable value depends on available buyers.

Bitquery’s October 25 reconstruction explains the governance mechanism: the three largest frozen stakes held the seats, two votes could pass a proposal, and execution could follow immediately. Two helper contracts each locked 19,000.000001 X, narrowly exceeding an existing member’s stake. The attack therefore bought control of a decision, rather than stealing a signer’s private key.

Read the token amounts, not today’s dollar badges

The first receipt shows a 1,942,457.637245 USDT transfer from Aave, purchases of 38,200.000002 X, two 19,000.000001 X deposits into the Freezer and separate 100 X payments. It then records the treasury’s 400,000 X transfer, a sale of 131,702.921165 X, loan repayment and the final USDT payout.

These are token quantities recorded in the transaction. An explorer’s dollar badges can reflect later prices; they should not be mistaken for historical proceeds. We describe the payout as approximately $4.75 million using USDT at $1, rather than the explorer’s changing fiat estimate.

The Defiant’s report independently identifies a governance takeover and approximately 4.85 million USDT across two transactions. Its full body did not load during our check, so it is corroboration of that reported headline finding, not our source for the detailed transaction accounting.

A long lock did not buy a response window

A stake lock can make voting expensive without making execution slow. If someone can acquire enough authority, pass a harmful instruction and monetize it within one transaction, the community has no interval in which to react to that instruction.

A waiting period, historical voting snapshots and constraints on where treasury assets can trade address different parts of that problem. None is a universal guarantee. The useful test is whether the complete path—from obtaining authority to receiving assets—has been reviewed together.

For another recent example of why the failure mechanism matters more than a headline total, see Panther’s Initia investigation.

What this evidence does—and does not—establish

The receipt verifies transfers; Blockaid and Bitquery supply the governance interpretation. It does not identify the human controllers or establish a developer conspiracy. Several addresses exploiting the same route do not, by themselves, prove common ownership.

Bitquery’s remaining-balance and Senate-control findings were a snapshot at 04:19 UTC on October 25. We have not independently refreshed those contract states and do not present them as today’s condition. A precise recovery commitment or current safety claim would need newer primary evidence.

Panther Takeaway

A treasury vote is a financial permission. Before trusting a project’s governance, ask what a winning vote can actually execute, at what price, and how long holders have to respond. A locked token is little comfort if the authority it buys can empty the market first.

PANTHER JOURNAL #060. Verification: October 26, 2026. USDT quantities are distinguished from dollar estimates; no attacker identity is asserted.