Protocols & Policy · Exploits
On-chain records for Ethereum transaction 0x38c60844… show a same-block borrow, vote and treasury sale that left about 4.75 million USDT with the attacker. Two common governance safeguards (a pre-proposal voting-power snapshot and a timelock) were not in the way.
A single Ethereum transaction at 10:11:47 a.m. ET on Oct. 24 borrowed about 1.94 million USDT, used part of that capital to seize two of three seats on X100's on-chain "Senate," sold 400,000 treasury X tokens, repaid the loan and sent about 4.75 million USDT to the attacker, all before the transaction ended [1][2].
Le Coin read the transaction 0x38c60844f1923d53fdce7d99e9bc2a2d8c73a08e793341dfbb479f8cc74d81d0 from a public node: it succeeded in block 26,263,022, created a helper contract, and emitted 55 logs [1][2]. This piece describes that transaction only. It is separate from any news write-up of the wider incident.
A flash loan lets a contract borrow tokens for the length of one transaction if it returns them (plus any fee) before the transaction finishes. In this receipt, about 1,942,457.64 USDT first moves to an intermediate contract, and about 1,943,428.87 USDT later moves back to the same lender address (the repay leg) [1]. USDT is a dollar-pegged stablecoin. Between those legs, the borrowed dollars are working capital for buying voting power and cashing out treasury tokens.
X100's Freezer / DexTreasury contract at 0x79F35A33FE2813414851c4Ae8daeacD14d822A46 appears throughout the logs [3]. After the borrow, the transaction buys about 38,200 X, the project's ERC-20 token, which uses six decimal places, and splits that balance into two helper addresses, each receiving about 19,100 X [1][4]. Each helper then transfers roughly 19,000 X into the Freezer. Freezer events fire in pairs around those deposits, consistent with two accounts joining the Senate by locking tokens [1][3].
With two of three seats, the same transaction proposes, records votes and executes. One Freezer log carries the on-chain description string testnet flash governance proof, which also appears in the transaction's input data [1][3]. Le Coin verified that string in both places before quoting it. Immediately afterward, Freezer logs show vote-related events, then a transfer of 400,000 X out of the Freezer into an attacker-controlled Uniswap-style pool that receives only about 35.68 USDT for that sale [1][3][4]. Empty or nearly empty pools let large token dumps clear at absurd prices when the seller controls both sides of the design.
Further swaps in the same receipt move millions of USDT through the intermediate contract. After the loan is repaid, about 4,749,726.10 USDT is transferred to the original sender, 0x7ec2afdF3eC5964899894f8D58afa95cbB8FfD63 [1].
Two standard governance designs are meant to stop exactly this pattern. Neither requires judging X100's intentions; they are mechanical checks other protocols use.
First, a voting-power snapshot taken before a proposal is created. If the votes that count are fixed at an earlier block, before the flash-loan buy, newly frozen tokens in the proposal's own transaction do not count. Here, freezing, proposing, voting and executing happen inside one transaction, so there is no earlier snapshot standing in the way [1].
Second, a timelock between a successful vote and execution. A delay of hours or days lets anyone see a malicious proposal and exit or intervene before treasury tokens move. Same-transaction execution leaves no delay [1].
Together, those two checks break the assumption that "governance takes many blocks." Flash-loan capital collapses buy, vote and steal into one atomic step when the contracts allow it.
Le Coin is not assessing whether X100's team should have known, only what this transaction did and which ordinary controls would have blocked that path.
Holding the Corner.
Not financial advice.