X100 Global vote moved treasury tokens in one block

X100 Global's public Senate page still tells holders that a passed proposal is executed by a separate transaction, and only in a pool that already exists. Treasury tokens moved on October 24, 2026 inside one successful Ethereum (ETH) transaction, at 14:11:47 UTC, and that same transaction created the pool that received them. For a custodian, the underwriting problem is that gap between the page and the block.

The monitors that posted that afternoon do not share one loss figure, because they are not counting the same set of transactions. BlockSec Phalcon estimated the suspicious transaction at $4.75 million. Blockaid, at 14:49 UTC, put realised Tether (USDT) at about $4.85 million across two transactions and described the exploit as still under way. Chainalysis, at 19:31 UTC, put stablecoin extraction at about $4.7 million across three transactions, plus about 560,000 X left unsold at attacker addresses.

What the block records

Etherscan records the transaction as successful in block 26,263,022. The address it labels X100 Exploiter 1 received 4,749,726.096973 USDT, the quantity behind BlockSec's estimate and ExVul's 4.75 million USDT. The staking contract sent 400,000 X and received 35.675313 USDT. ExVul's net of 361,799.999998 X is that swap minus X deposited into the same contract during the transaction. Aave sent 1,942,457.637245 USDT toward a purchase of 38,200 X on Uniswap V3, split so two contracts could each freeze just over 19,000 X.

Related:WAX blockchain bridge exploit paused processing, then resumed

BlockSec Phalcon's 15:44 UTC alert says those seats swapped 400,000 X into a new PancakeSwap V3 pool, minimum output zero, for about 35.68 USDT, then sold part of the recovered X in the existing Uniswap V3 pool and repaid the loan. ExVul, at 16:31 UTC, matched the 100 X application fee and the 35.675313 USDT the treasury received.

The root cause stems from a governance design flaw that allowed the attacker to acquire two of three Senate seats using flash-loan-funded X tokens and immediately approve and execute a malicious treasury proposal within the same transaction.

Why the dollar totals diverge

Blockaid added a second attacker who burned the Freezer's Uniswap V3 positions and said about $4.85 million of USDT had been realised across two transactions while the attack was still under way. Chainalysis said the stablecoins were swapped for ETH and split across four wallets holding 400 ETH each, with follow-on attackers also taking value. BlockSec and ExVul match the Etherscan receipt, while Blockaid and Chainalysis were still adding transactions, so one dollar figure would choose a perimeter.

What X100 Global still publishes

The project's learn page, with a published time of October 23, 2026, says a passed proposal is executed by a separate transaction anyone can send, and that swaps run only in pools that already exist. It defines the treasury as the staking rewards pool, says staked X stay in place, and says three seats are in place at launch. The homepage, opened on October 26, still shows a three-day voting period and a 100 X application fee. X100 Global's swap shares the 14:11:47 UTC hash with the creation of the pool that took the 400,000 X.

The account displayed as X 100 Global, @x100global, still led the posts loaded on October 26 with an October 21 greeting and an October 20 note on payments, staking and trading. The homepage panel, marked as a 24-hour read, showed X at $1.75, down 96.58%, on volume of $17,570,516.35, beside a staking-rewards balance of 11,993,618 X.

What a treasury desk should weigh

A three-seat Senate filled with tokens bought in the same transaction prices control as a loan fee. The homepage caps market inventory at 1,000,000 X and says each decision must leave staked X in place. A 400,000 X sale fits under that cap, so frozen-stake checks leave the rewards pool open to a one-block majority. DeFi Development's CHAD buyback authorisation sat on the books before tokens moved. Here the tokens moved inside the vote. Standard Chartered's signed agreement to buy Zodia Custody names a custodian. The Senate contract ranks seats by the latest stake. The WAX bridge pause, later lifted, showed an operator able to stop processing. X100 Global's pages on October 26 were still serving a price and the earlier voting description.

A useful follow-up separates the 4,749,726.096973 USDT receipt from later burns and from the unsold X that Chainalysis left outside the stablecoin total. Until that split is explicit, a campaign-level dollar total will keep moving as each firm adds a transaction.

This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.