X 100 Global: alleged governance takeover allowed its treasury to be drained

A takeover of decision rights

Security teams reported on October 24 a takeover of the governance of X 100 Global, reports Bitcoin.com News. The described scenario relies on obtaining two seats among the three of the project's 'Senate', then using this majority to move assets from its treasury. This is not an attack against a parliamentary institution. Blockaid estimates the extracted products in USDT at approximately 4.85 million dollars, with additional token movements.

The published analyses describe a failure of organization of voting rights rather than a simple error in a line of code. A contract can correctly execute programmed rules while authorizing a dangerous decision if those rules allow taking control quickly. The security of a treasury therefore also depends on how votes are acquired, counted, and executed. The technical functioning of the contract does not guarantee that its governance resists an actor seeking to divert the mechanism.

The role of the instant loan

According to the Exvul analysis cited in the account, the attackers would have used an instant loan to acquire the necessary voting power. This type of loan must be repaid in the same transaction, otherwise the operation is canceled according to its intended functioning. It allows mobilizing a large amount of capital temporarily. This is not fraud in itself: the risk appears when another mechanism treats this temporary power as a durable right of decision or control.

Vote histories, minimum holding durations, or execution delays can limit certain scenarios, depending on the design adopted. Their effectiveness depends on the precise rules and powers that remain available. The existence of such protections must not be assumed when it is not established in the concerned project. In the scenario reported for X 100 Global, the rapid acquisition of seats and the immediate execution of decisions would have made it possible to chain financing, takeover, and asset exit.

A price that does not guarantee exit

The X token fell sharply after the incident, while the analyses describe a drying up of liquidity on certain decentralized markets. The last displayed price then does not guarantee that a holder can sell a large quantity at that level. In a shallow pool, an order can strongly move the exchange rate and create a gap between the expected price and the obtained price. A price variation and a loss of liquidity are linked, but constitute two different measures of the situation.

The extracted amounts and the chronology must remain associated with the updates from the security teams. A balance published during the incident can evolve when other transactions are identified. It does not allow promising a recovery of funds nor designating an individual responsible without additional elements. The case above all highlights the economic role of governance rules: protecting a treasury requires controlling who can decide, with what rights and after what delay, as much as the execution of the contracts themselves.