X100 Global exploit: flashloan buys control of treasury, $4.85M drained
- —Aave flashloan of ~1.94M USDT bought X tokens and two of three senate seats
- —Treasury sold 400,000 X for just 35.68 USDT into an attacker-created pool
- —Blockaid puts losses at ~$4.85M USDT plus 550,000 X; BlockSec at $4.75M
- —The X token collapsed more than 96% after the attack
Why it matters: The case shows governance without a voting snapshot, holding period and timelock lets an attacker empty a treasury in a single transaction.
Source: CryptoTicker