BlockSec: X100 Global Suspected of Governance Attack; Attacker Exploited Vulnerability to Steal Approximately 4.75 Million US Dollar

BlockSec monitoring has detected an attack on X100 Global on the Ethereum network that exploited a flaw in its governance mechanism, resulting in approximately $4.75 million in losses. The attack’s core sequence was as follows: the attacker used a flash loan to acquire funds, purchased X tokens, deployed those tokens across two contracts under their control, and then deposited both into the Freezer contract—thereby securing two out of three Senate seats within a single transaction. With this governance majority, the attacker swiftly proposed, approved, and executed a malicious treasury proposal. Specifically, the attacker first added liquidity to the X-USDT pool on PancakeSwap V3; then, leveraging their newly acquired governance majority, approved a proposal to swap 400,000 X tokens into that same pool—with a minimum output amount set to zero; the swap yielded only ~$35.68 in USDT. Finally, the attacker immediately withdrew all liquidity to complete the arbitrage.