X100 Attacker Drains $4.85M in USDT Following Governance Takeover

An attacker seized control of protocol governance at X100, draining 4.85 million $USDT from the platform on Oct. 24, 2026 ¹. According to reporting from The Defiant, the unauthorized takeover enabled the perpetrator to execute two key transactions that converted the protocol's treasury tokens and liquidity positions directly into stablecoins ¹.

Security firm Blockaid warned that the attack on the Ethereum-based protocol remained ongoing as the extraction occurred ¹. The incident targeted both underlying liquidity holdings and stored protocol reserves, routing the liquidated assets into USDT on the Ethereum network ¹. At the time of writing, $ETH traded at $2,340, while broader market sentiment sat neutral amid ongoing protocol risk alerts across decentralized finance.

Treasury Extraction Details

The exploit reflects continued vulnerabilities in protocol governance architectures, where malicious entities leverage administrative takeovers to reallocate reserves ¹. By capturing the governance mechanism, the attacker directed liquidations across available pools to secure 4.85 million USDT without needing standard redemption procedures ¹.

Blockaid identified the incident on Ethereum as an active threat, signaling that monitoring operations remained underway following the two liquidation transactions ¹. The exact technical path utilized to achieve the governance takeover was not detailed in initial incident notifications ¹. No official statement had been published by the X100 team regarding recovery measures, asset freezes, or contract pauses at the time of publication ¹.