blockintAI · Research blog

X100 and Yapeswap: Two Ethereum Governance Takeovers 12 Hours Apart, One by Flash Loan, One by a Nine-Day Proposal

BlockintAI · 2026-10-26T22:33:54.429Z

On October 24, 2026, two projects on Ethereum were drained through their own governance. Neither attack needed a bug in the usual sense. Both used the rules exactly as written.

At X100, at 9:11 AM CT, one transaction borrowed about 1.94M USDT, bought enough X tokens to take two of the three seats in X100's "Senate", voted, and made X100's treasury sell 400,000 X for $35.68 into a pool the attacker had just created. The attacker left with 4,749,726.10 USDT. Two more wallets used the same path within half an hour.

At Yapeswap, a small Uniswap-style exchange, the attack took nine days. At 9:15 PM CT, a proposal that had sat on-chain since October 15, backed by 543.98 YAPE, executed and made the attacker the admin of the Yapeswap factory. Five minutes later, 12 trading pools had been emptied of about $24,800.

This follows the Arkadiko governance attack on Stacks two days earlier. Times are in US Central Time (CT), with UTC in brackets where it matters.

Key facts

X100 Yapeswap
When Oct 24, 9:11:47 AM CT (14:11:47 UTC) Proposal Oct 15, 9:13 PM CT; executed Oct 24, 9:15 PM CT
How control was taken Flash-loaned X frozen in two helper contracts won 2 of 3 Senate seats A WorkersUnion proposal backed by 543.98 YAPE passed with zero quorum (per SlowMist)
What the attacker got Treasury sold 400,000 X for 35.68 USDT; attacker kept 4,749,726.10 USDT Factory admin role; fake vault registry drained 12 pools
Loss $4.75M first attacker (BlockSec Phalcon, ExVul); ~$4.85M USDT across the first two attack transactions (Blockaid; 4,846,107.98 USDT on-chain) ~$21.9k first transaction (SlowMist); ~$24.8k across both drains (on-chain amounts at CoinGecko prices)
Where it is now 2,022.86 ETH in five wallets, unmoved as of 7:47 AM CT Oct 26 10.52 ETH in the attacker wallet, unmoved since Oct 24 as of 7:47 AM CT Oct 26
Attacker gas ETH from the Etherscan-labeled FixedFloat: Hot Wallet 2 (this does not implicate FixedFloat) 0.009975 ETH from the Etherscan-labeled Railgun: Relay
Project statement None on X as of 8:00 AM CT Oct 26 None found on X as of 8:00 AM CT Oct 26
BlockintAI reports attacker and holding wallets, exploit contracts attack, follow-up with the second drain

X100: a Senate bought for one transaction

How the Senate worked

X100 keeps its treasury in a contract called the Freezer (0x79f35a…2a46). Holders lock ("freeze") X in it. According to BlockSec Phalcon and ExVul, anyone could join the three-seat Senate immediately for a 100 X fee, and the seats went to whoever had the most X frozen at that moment. There was no voting snapshot, no minimum holding time and no delay between a vote and its execution. Two of three seats could pass a proposal and run it in the same transaction.

The attack transaction

The attacker's wallet, 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63, is tagged X100 Exploiter 1 on Etherscan. It was brand new. Its only funding was two transfers at 9:05 and 9:06 AM CT from the address Etherscan labels FixedFloat: Hot Wallet 2, an instant swap service. This does not implicate FixedFloat.

Five minutes later it sent the attack transaction (block 26,263,022). It was a contract creation: it deployed 0x89e903e4512f8a315cebd99c29a1e40eee6fe2c9, which in turn created 0x37541fc4a6f1ec86889ba506f51dc39f2bedd10a, the contract ExVul calls the exploit coordinator. Inside that one transaction, per BlockSec Phalcon, ExVul and the transaction's on-chain transfers:

  1. About 1.94M USDT was flash-loaned from Aave and used to buy about 38,200 X.
  2. Two helper contracts froze 19,000.000001 X each. That beat the 19,000 X held by the second-biggest Senate member by one millionth of a token, the smallest unit X can count, and took seats two and three.
  3. The attacker created a new PancakeSwap V3 X-USDT pool with a tiny amount of liquidity.
  4. Proposal #7, which told the Freezer to swap 400,000 X for USDT in that new pool with a minimum output of zero, was proposed, voted and executed. The treasury received 35.675313 USDT.
  5. The attacker pulled its liquidity back out, sold part of the X into X100's real Uniswap V3 X-USDT pool and repaid the loan.

At the end of the transaction, 0x89e903…e2c9 paid 4,749,726.10 USDT to the attacker's wallet.

In the hours before the attack, Senate members had been the main buyers in the pool the attacker sold into. From midnight UTC on October 24 (7:00 PM CT October 23) until the attack, 44 buys put 4,887,998.53 USDT into X100's Uniswap V3 X-USDT pool. 98.7% of that USDT came from transactions sent by two wallets that had proposed and voted in the Freezer's Senate, and the last of their buys landed at 9:09:47 AM CT, two minutes before the attack (pool events on Etherscan).

Two more wallets through the same door

Blockaid flagged the attack while it was still under way, reported that a second attacker "burned the Freezer's Uniswap V3 positions", and later reported a third attacker that "used the same Senate path" and pulled the remaining ~550,000 X of Uniswap V3 liquidity. On-chain:

  • 9:35:59 AM CT, 0xfc3facd67138966ab0c841e905b0c4bca1abe92f ran the same play with a flash loan from Morpho. In that transaction the Freezer's five Uniswap V3 positions were closed, returning their X to the Freezer, and the Freezer then swapped 49,999.999995 X into a pool created earlier in the same transaction for 0.000644 USDT. Its payout wallet, 0xedac2d…d0c8, received 96,381.88 USDT and 9,894.89 X in that transaction.
  • 9:40:47 AM CT, a third wallet, 0xdab137…f8c8, which Etherscan tags X100 Exploiter 2, sent a transaction that moved about 549,916 X and 1,909 USDT out of the Freezer's positions to another address. A contract deployed in that transaction called two helper contracts that had been created inside the second attacker's transaction, 0xc2f69b…73ba and 0xb21f45…7cde, and both carried out its calls to the Freezer (Blockscout trace). Public data does not show whether the second and third wallets are controlled by the same person.

The first two transactions paid out 4,846,107.98 USDT between them (4,749,726.10 + 96,381.88), matching Blockaid's ~$4.85M.

The second wallet has done this before

0xfc3fac…e92f is not new. DeFiHackLabs, the open-source exploit reproduction project, lists it as an attacker in its proof-of-concept files for the Position Manager exploit on BNB Chain (September 30, 32,080.60 USDT) and the Set Protocol ETHMACOAPY exploit (October 6). Blackpaper lists it as the sender of four attack transactions in the Malt exploit on Polygon (October 3). PublicAML, an independent researcher, labels it as an attacker wallet of the Limit Break Payment Processor V2 drain. The three incidents with explorer-verifiable records are on blockint.ai (Position Manager, Set Protocol, Malt).

Its X100 proceeds moved fast. On-chain, the payout wallet 0xedac2d…d0c8 swapped the USDT to about 40.9 ETH, and within about 20 minutes of the attack the ETH had passed through two one-time wallets (0x35dcab…814d and 0x37069e…99ab) to an address Etherscan tags ChangeNOW Dep. Funds were sent to ChangeNOW; this does not implicate ChangeNOW.

The first attacker's ETH has not moved

The first attacker swapped its USDT for ETH in two UniswapX orders at 9:16 and 9:17 AM CT (851.54 and 1,170.47 ETH, through the Etherscan-labeled UniswapX: Dutch Order Reactor V2), then sent 1,000 ETH and 1,022.86 ETH to 0x8296721489d0a7e934edd66ea27159b1c88a42e5 at 9:18 and 9:19 AM CT. Between 9:39 and 9:43 AM CT that wallet sent 400 ETH each to four new wallets:

ScamSniffer named all five that morning. When we re-checked at 7:47 AM CT on October 26 (Ethereum block 26,276,953), they held 422.86, 400, 400, 400 and 400 ETH (2,022.86 ETH). None of the four 400 ETH wallets has ever sent a transaction, and 0x829672…42e5 has sent nothing since its four transfers.

Address poisoners went after these wallets too. As of 7:47 AM CT October 26, Etherscan shows 25 fake "ETH" token transfers, from nine token contracts, made to look as if they came from the attacker's wallet between 9:20 AM CT October 24 and 9:57 AM CT October 25. Twenty-four went to five lookalike addresses that start 0x8295 or 0x8296 and end 42e5, the same first four and last four characters as the real holding wallet.

Yapeswap: a takeover voted through in public

Yapeswap runs a Uniswap V2-style factory, YapeFactory (0x46adc1…35a2), whose pairs can park idle tokens in farming vaults chosen by a registry. Its governance runs through a contract named WorkersUnion (0x5d3580…5ddb), with votes from YAPE locked in a VotingEscrowLock contract. All of the steps below are in the attacker wallet's public history on Etherscan: 0x6e523866424220b3cb2cab88ba2195cfa5636b12.

Nine days on-chain

  • Oct 13, 8:23 AM CT: first funds, 0.009975 ETH, withdrawn from the contract Etherscan labels Railgun: Relay and passed through a one-time address (transaction). RAILGUN is a privacy protocol, so the source of those funds is not visible.
  • Oct 15, 9:12 PM CT: the wallet bought 543.98 YAPE through YapeRouter for 0.000000001 ETH, approved it, locked it in VotingEscrowLock and delegated the votes.
  • Oct 15, 9:13 PM CT: it filed a proposal on WorkersUnion (transaction). Decoded, the proposal calls setFeeToSetter on YapeFactory with the attacker's own address, with a one-day delay before voting and a seven-day voting period.
  • Oct 16, 9:20 PM CT: it voted yes on its own proposal (transaction).
  • Oct 23, 9:14 PM CT: it scheduled the passed proposal (transaction).
  • Oct 24, 9:15 PM CT: it executed it (transaction), nine days and two minutes after filing, becoming YapeFactory's feeToSetter.

SlowMist explains why it passed: WorkersUnion's quorum was zero, so a proposal backed by about 0.000055% of voting power was enough.

Five minutes to drain

At 9:18 PM CT (block 26,266,649), the wallet deployed its exploit contract, 0x327bf6dfc38a79393f78866c705193c39b04be01 (transaction). In the same transaction that contract created a registry, 0xc620ca5b2a63cdb792d462898010d2be4421b5a7, and the registry created five fake vaults, one each for DAI, USDC, WETH, USDT and WBTC. In the same block, now holding the admin role, the wallet called setOperator, setRegistry (pointing YapeFactory at the fake registry, transaction) and setFeeTo on YapeFactory.

The fake registry answered latestVault with a fake vault while still listing the real vaults, so pairs believed they were depositing into a farm. Each fake vault took the pair's tokens and sent them to the exploit contract.

  • 9:19 PM CT: the first drain emptied six pairs, about $21,988 (SlowMist's ~$21.9k).
  • 9:20 PM CT: a second drain hit six more, about $2,854.
  • 9:20:47 PM CT: a harvest() call (transaction) swapped 8,386.28 USDT, 2,286.17 USDC, 1,691.85 DAI and 0.0316 WBTC to WETH on Uniswap V3, unwrapped it with the 4.205 WETH taken, and sent 10.516 ETH to the attacker's wallet.

Our on-chain review puts the total at about $24,842 (CoinGecko prices near 9:20 PM CT on Oct 24: ETH about $2,360, WBTC about $80,650, stablecoins at $1). When we re-checked at 7:47 AM CT on October 26, the wallet held 10.5245 ETH and had sent nothing since the harvest.

What this means

  • Fast or slow, the same flaw. X100's Senate could be bought and used inside one transaction. Yapeswap's governance had a delay and a voting period, but no quorum, so a proposal that sat in public for nine days with one voter still passed. A delay only protects a protocol if someone is watching.
  • Voting power must be measured before the vote. X100 counted frozen balances at the moment of the vote, which is what made a flash loan enough. Snapshots taken before a proposal opens, plus a waiting period before execution, block this pattern.
  • Admin roles are the real prize. At Yapeswap, the attacker never touched user funds directly. It voted itself the factory's feeToSetter, and that role was enough to swap in a fake registry. Any role that can redirect funds should sit behind more than one vote.
  • The trail stays public. As of 7:47 AM CT October 26, the first X100 attacker's 2,022.86 ETH and the Yapeswap attacker's 10.52 ETH had not moved.

If you lost money in a hack or any crypto theft, report it to ic3.gov and the FTC, and file a report at blockint.ai so others can see the addresses involved.

Sources