The Ethereum-based X100 project recently experienced a significant cyberattack, resulting in the loss of approximately 4.85 million USDT and hundreds of thousands of X tokens. This incident was confirmed by blockchain security firm Blockaid, highlighting serious vulnerabilities within the project’s governance structures.
According to Blockaid’s findings, one of the attackers managed to gain control over two out of three seats on the project’s governing body. With this majority, the attacker sold off 400,000 X tokens from the project’s treasury into a specially created empty liquidity pool.
The coordinated attack escalated when a second hacker targeted the project’s Freezer smart contract, burning the associated Uniswap V3 liquidity positions. This further compounded the losses, as a third attacker exploited the same governance loophole to withdraw an additional 550,000 X tokens from Uniswap V3.
As a result of these malicious activities, the total stolen assets stand at around 4.85 million USDT, alongside 550,000 X tokens removed from the protocol. Although the attack is ongoing, Blockaid noted that there are still approximately 12.2 million X tokens held securely in the Freezer contract.
This incident serves as a stark reminder of the security challenges faced by projects operating on decentralized platforms, where governance mechanisms can be exploited. Stakeholders are urged to remain vigilant as investigations into the attack continue.
