On 24 Oct 2026 X100 ($X) on Ethereum lost ~$4.85M in a flash-loan governance takeover, CertiK reports.

Attacker 0x7ec2…ffd63, funded with gas by FixedFloat minutes before, borrowed ~1.94M USDT from Aave, bought 38,200 X on the Uniswap V3 main pool 0x0d85…02fa0, froze 19,000 X in each of two helper contracts and took 2 of 3 Senate seats in the same transaction, per ExVul and oculr.

Freezer 0x79F3…22A46 ranks seats by live frozen balance with 100 X to run, no snapshot, no stake age, no timelock, so proposal #7 auto-voted yes, got the second vote and executed at once, forcing a 400,000 X sale for only 35.67 USDT into attacker-created pool 0x9A03…6f075, as GoPlus details.

First tx 0x38c6…d81d0 at 14:11 UTC dumped the drained X back to the main pool for 6.69M USDT, repaid Aave and sent 4,749,726 USDT to the attacker. Two more txs brought total main-pool outflow to 4,848,988.78 USDT, attacker net 4,848,017.34 USDT plus ~828,094 X unsold, X fell ~96%.

Proceeds were swapped to ~2,022 ETH, split to four 400 ETH wallets plus 423 ETH in distributor, then to Tornado Cash: 420.8 ETH via 0x8296…42e5 and 400.4 ETH via second depositor, The Defiant and CertiK report. No recovery is reported; DefiLlama records $4.75M with $0 returned.

Sources do not name a fixed attacker identity beyond the FixedFloat-funded EOA and executor 0x3754…d10A.