X100 exploit: flash-loaned Senate drained $4.75M

On 24 October 2026 an attacker used a ~1.94M USDT flash loan to buy 38,200 X tokens and seize two of three X100 Senate seats, outbidding incumbents by one millionth of a token. A proposal routed 400,000 X from the treasury into an attacker-made PancakeSwap pool with minOut = 0, netting about $4.75M; Blockaid puts the total at roughly $4.85M and ~550,000 X across three transactions.

• Flash loan of ~1.94M USDT bought 38,200 X and two Senate seats
• Treasury sold 400,000 X for 35.7 USDT with minOut set to 0
• Main transaction loss reached about $4.75M in USDT
• Blockaid estimates total losses at $4.85M and ~550,000 X