---
title: "X100 Attacker Drains $4.85M in USDT Following Governance Takeover"
description: "Treasury tokens and liquidity holdings were converted across two transactions in an ongoing Ethereum exploit flagged by Blockaid."
url: https://basisdesk.news/news/x100-governance-exploit-usdt-drain
published: 2026-10-24T19:49:56.899Z
modified: 2026-10-24T19:49:56.899Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [USDT, ETH]
tags: [x100, exploits, ethereum, governance, blockaid, usdt]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# X100 Attacker Drains $4.85M in USDT Following Governance Takeover

Treasury tokens and liquidity holdings were converted across two transactions in an ongoing Ethereum exploit flagged by Blockaid.

## At a glance

- **What happened:** An attacker drained 4.85 million USDT from X100 after executing a governance takeover on Ethereum on Oct. 24, 2026.
- **Why it matters:** The hostile takeover allowed the unauthorized liquidation of protocol treasury reserves and liquidity holdings into stablecoins.
- **Who is affected:** The X100 protocol and liquidity providers exposed to the drained pools.
- **What's next:** No next step announced.
- **Primary source:** [X100 Exploit Nets 4.85 Million USDT After Governance Takeover](https://thedefiant.io/news/hacks/x100-exploit-nets-4-85-million-usdt-after-governance-takeover) — thedefiant.io

## Key points

- X100 was exploited for 4.85 million USDT on Oct. 24, 2026, following a governance takeover [1].
- The attacker converted protocol treasury tokens and liquidity positions across two transactions [1].
- Security firm Blockaid warned that the Ethereum-based attack was ongoing [1].

## Editorial remark

- **Context:** Governance takeovers occur when malicious actors obtain sufficient voting weight or administrative privileges to pass malicious actions directly against treasury contracts.
- **Impact:** X100 suffered an immediate loss of 4.85 million USDT, impacting the protocol's liquidity positions and underlying treasury reserves.
- **Watch:** Monitoring for subsequent fund movements from the attacker address and any post-mortem analysis from Blockaid or the X100 team.

An attacker seized control of protocol governance at X100, draining 4.85 million $USDT from the platform on Oct. 24, 2026 [1]. According to reporting from The Defiant, the unauthorized takeover enabled the perpetrator to execute two key transactions that converted the protocol's treasury tokens and liquidity positions directly into stablecoins [1].

Security firm Blockaid warned that the attack on the Ethereum-based protocol remained ongoing as the extraction occurred [1]. The incident targeted both underlying liquidity holdings and stored protocol reserves, routing the liquidated assets into USDT on the Ethereum network [1]. At the time of writing, $ETH traded at $2,340, while broader market sentiment sat neutral amid ongoing protocol risk alerts across decentralized finance.

## Treasury Extraction Details

The exploit reflects continued vulnerabilities in protocol governance architectures, where malicious entities leverage administrative takeovers to reallocate reserves [1]. By capturing the governance mechanism, the attacker directed liquidations across available pools to secure 4.85 million USDT without needing standard redemption procedures [1].

Blockaid identified the incident on Ethereum as an active threat, signaling that monitoring operations remained underway following the two liquidation transactions [1]. The exact technical path utilized to achieve the governance takeover was not detailed in initial incident notifications [1]. No official statement had been published by the X100 team regarding recovery measures, asset freezes, or contract pauses at the time of publication [1].

## Sources

1. [X100 Exploit Nets 4.85 Million USDT After Governance Takeover](https://thedefiant.io/news/hacks/x100-exploit-nets-4-85-million-usdt-after-governance-takeover) — thedefiant.io, 2026-10-24

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai