22:49. That's the only timestamp Blockaid gave us, and it's the one that matters. X100 โ a small Ethereum governance-and-liquidity protocol โ was still being drained while the alert was being written. Two transactions. Roughly 4.85 million USDT gone. No reentrancy hook. No oracle twist. No nine-figure flash loan. The attackers needed two votes and a pool they built themselves.
I don't need a full trace to recognize the shape of this. I've seen the shape. The 2017 break didn't teach this industry anything about seat counts โ it taught us about admin keys. Same disease, new organ.
Let me draw the information boundary first, because speed without a boundary is just noise with a timestamp. Known: asset type (USDT), approximate haul (4.85M across two transactions), vector (governance seizure, treasury dump, LP destruction), headcount (at least two attackers). Unknown: TVL, X supply, audit history, team identity, whether the stables have been bridged or mixed. Everything below sits on the known side of that line. Where I infer, I flag it.
Three seats is not a governance model. It's a coin flip with paperwork.
X100 runs a "Senate" โ three seats, on-chain voting. Hold two and you are the protocol. Not a supermajority in the ceremonial sense. An absolute one: 2/3 clears any proposal, vetoes nothing, and reaches both the treasury and the Freezer contract.
Freezer is the part most readers will skim. It holds Uniswap V3 LP positions. Those aren't fungible balances in a vault; they're NFT-wrapped concentrated-liquidity ranges, each a claim on a specific pair inside a specific price band. Redeem the NFT, pull the underlying out. That's the design. It's also why "Freezer" is such a loaded name for a contract that turned out to have no freezer in it.
The guardrails against exactly this are boring and well documented: a timelock between proposal and execution, a guardian or veto address that can slam the brakes, a quorum expensive enough that no single actor clears it, and physical separation between the governance module and the asset vault. X100 appears to have shipped none of them. "Appears" because the evidence is behavioral โ the attack is still running. A protocol with a pause function and a responsive team does not stay drained for the length of an alert cycle. Either the mechanism doesn't exist, or nobody is home to press it. For depositors, those are the same answer.
Now the mechanics.
Two of three Senate seats fall. With control, the attacker pulls 400,000 X from the treasury and dumps it โ not into an external AMM where slippage, MEV searchers, and price impact would eat the trade, but into a pool they seeded themselves. That isn't selling. It's self-dealing with extra steps: you pick the counterparty, you pick the price, you pick the depth. External pools have guards. A pool you built has your guards.
Then the second outlet opens. Freezer's Uniswap V3 LP positions get destroyed, the underlying redeemed out. That is where the bulk of the value almost certainly sits, and here's the division the alert doesn't do:
If all 4.85 million had come from dumping 400,000 X, each token would have cleared roughly $12. That implies a fully diluted valuation no long-tail protocol with a three-person senate carries, and it requires pool depth a self-seeded pool by definition lacks. So the X dump wasn't the payday. It was the noise. The LP redemption inside Freezer carried the weight, with the token dump layered on top to make the exit look like a market event.
I built a crude Uniswap V2 reserve watcher during the 2020 DeFi summer โ Python, polling reserve deltas, nothing fancy โ and the lesson it drilled into me is that thin pools don't hide their stress, they broadcast it. A 400,000-token dump into a pool with real depth leaves a crater you can read for hours. A dump into a pool you control leaves nothing. When a "sell" produces no visible price impact anywhere, you're not watching a sale. You're watching a withdrawal wearing a trade's clothing.
Two attackers, per the alert. My read โ low confidence, flag it โ is one path, not two. The first actor exposes the entry point by taking the seats; the second moves on the LP while the protocol is still paralyzed. That's not a crew with a novel exploit. That's opportunism with a stopwatch.
I don't care how clean the vote tally looked on Etherscan. The tally is the weapon.
Stop calling this a hack. That's the uncomfortable part.
The reflexive framing tonight will be "another DeFi exploit," and the reflexive blame will drift toward Uniswap V3 because the LP lived there. Wrong on both counts. Uniswap V3 was the filing cabinet, not the thief. The protocol did precisely what its code said it would.
What actually happened is a hostile takeover executed through the front door, using the governance interface exactly as intended, by an actor who never needed a private key to steal. Different threat category. Cheaper, too. Buying two senate seats in a small-cap governance token costs a fraction of the 4.85 million it returned. When voting power is withdrawal power, the token isn't a governance asset โ it's a mispriced call option on someone else's treasury. Markets price that option at zero right up until the moment they don't.
Here's the part that will make the policy crowd squirm. I've spent enough hours in Brussels hearing-room corridors translating MiCA text into plain English to know there is no comfortable article for this. Custody rules assume a custodian. Disclosure rules assume a disclosure. Nobody drafted for "token holders voted, and the vote was the theft." The legal vocabulary is a step behind the exploit, again.
And the victims are not the people who aped the token. They're the depositors who moved Uniswap V3 LP into Freezer because a lock product implied a lock. They did the careful thing. A vote cleared them out.
Watch the freeze list, not the chart.
The next 48 hours are about whether those stables are still taggable. Tether's freeze process is the only stop-loss that has ever worked at this speed, and it works only while the funds sit still. After that, watch for a governance-health screening wave โ every small protocol running an N-of-3 or N-of-5 council is about to have its quorum math read out loud. That's the positioning signal in a chop market. Seat counts before code audits.