Blockaid Flags $4.85M USDT Drain From Ethereum (ETH) Project X100 as Attack Continues

Blockaid Flags Ongoing X100 Exploit

Security firm Blockaid has disclosed that X100, an altcoin project built on Ethereum (ETH), is under an active attack that has so far moved roughly $4.85 million in USDT out of the protocol. USDT is the dollar-pegged stablecoin in which most of the stolen value is denominated, which makes the loss directly readable in dollar terms. The firm published successive updates through Sunday as each new attacker operation surfaced, and its latest statement says the attack is still in progress. All three operations trace back to one opening move: capture of the project's governance. On-chain data shared by Blockaid shows the first attacker took control of two of the three Senate seats inside X100's governance mechanism, the voting body that authorizes treasury actions. Holding a majority of those seats removed any need for further approval, and the attacker used that authority to sell 400,000 X tokens from the project treasury into an empty liquidity pool created for the purpose. A second attacker then burned the Uniswap V3 liquidity positions tied to the project's Freezer smart contract. Burning a position strips out the assets locked inside it, which is how funds held in the pool became tokens the attackers control outright. A third attacker, working through the same captured governance, withdrew the remaining Uniswap V3 liquidity, about 550,000 X tokens, from the protocol. Blockaid's running tally across the three transactions stands at roughly $4.85 million in USDT plus 550,000 X tokens removed from the protocol. The firm treats the three operations as the work of distinct attackers, each moving after the governance capture was already complete. The disclosure lands with the Ethereum (ETH) price under pressure this month, though the damage reported so far is concentrated in one protocol rather than in the network itself.

12.2 Million X Tokens Still Exposed

The figure that matters most going forward is what has not been taken yet. Blockaid reports that the Freezer contract still holds roughly 12.2 million X tokens and that, as of its latest update, the attack had not stopped. That leaves a treasury balance several times larger than the amount already drained exposed to whoever controls the Senate seats. Any further withdrawals would require the same captured authority, which the attacker has already demonstrated twice over. At the time of writing, no post-mortem from the X100 team, no attacker addresses and no transaction hashes had been published, so remediation is limited to what the security firm's monitoring shows. The sequence matters: governance capture came first, and both liquidity drains, one through Freezer and one through the governance channel, depended on it. The mechanics behind the stolen positions are standard DeFi plumbing: Uniswap V3 concentrates liquidity into discrete price ranges, and burning a position hands the underlying assets to whoever controls the burn. An empty pool, meanwhile, gives stolen tokens a place to be sold into immediately, which is why the attacker created one before selling the first 400,000 X. How much of the $4.85 million has already been sold into that pool, and at what price, is not disclosed. The episode also lands in an unforgiving market. Ethereum has fallen 13% in 30 days, a decline close to triple Bitcoin's over the same window, and on-chain trackers recorded a 26,974 ETH long worth $63.88M opened by one whale after the dip below $2,300. Neither figure changes the mechanics of the breach, but both shape how far stolen X tokens could pressure the market if they hit order books while sentiment is already weak. Broader support and resistance levels for the network's asset sit in our Ethereum technical analysis, and network-level coverage is collected on the Ethereum (ETH) tag page.

Our read: the root cause here is concentrated governance, not a flawed pool. Two of three Senate seats were enough to authorize treasury sales and liquidity withdrawals, so the protocol's security reduced to whoever held those seats. The market-relevant question is whether the remaining 12.2 million X tokens can be moved to safety before the attacker returns. Blockaid describes an intention to keep monitoring, not a containment step, and the X100 team's response is still unreported. Until a freeze or a team statement appears, the honest description of the outcome is that detection has happened and containment has not.