X100 exploit: the attacker’s gas came from FixedFloat, the second raid was run by a Limit Break attacker wallet, and all 2,022.86 ETH still sit on five addresses

X100 Global runs a stablecoin-style treasury around its X token (0x100a2c7f45fd48e217fdce72e658dc78fd43a100), governed by a three-seat Senate: anyone could become a candidate for a 100 X fee, seats went to the largest balances frozen in the Freezer contract (0x79f35a33fe2813414851c4ae8daeacd14d822a46) at that moment, and a proposal could be created, voted and executed inside one transaction. Blockaid flagged the exploit at 14:49 UTC on 24 October, ExVul decoded the transaction, BlockSec put the loss at about $4.75 million, and Chainalysis reported that the stablecoins were swapped into ETH and split across four wallets holding 400 ETH each. Blockaid later counted about 4.85 million USDT and roughly 550,000 X taken across three transactions, and X fell by more than 96 per cent. X100 Global had not issued a statement by the time this was written.

The attacker wallet 0x7ec2afdf3ec5964899894f8d58afa95cbb8ffd63 sent one transaction at 14:11:47 UTC (block 26,263,022). It deployed a contract (0x89e903e4512F8a315ceBD99c29a1e40EeE6Fe2C9), which deployed a coordinator (0x37541fc4a6f1ec86889ba506f51dc39f2bedd10a), which borrowed 1,942,457 USDT from Aave v3, bought 38,200 X from the Uniswap V3 X/USDT pool (0x0D85edD90c94053Fc5997551b1BAa8A77Aa02Fa0) and split them 19,100 each to two helper contracts. Each helper froze 19,000 X and paid the 100 X candidate fee: two Senate seats, bought for the length of a block.

With the majority, the coordinator made the treasury call its own v3Swap with a minimum output of zero, selling 400,000 X into a Dackie V3 pool (0x9A03c41c539880b51508bEbbc2Dde7B738f6f075) the attacker had created in the same transaction. The treasury received 35.68 USDT; the attacker took the 399,987 X out of the pool, sold 131,703 of them into the Uniswap pool for 6,693,090 USDT, repaid 1,943,429 USDT to Aave, and passed 4,749,726 USDT to the deployer and then to the wallet. The remaining 268,284 X stayed in the coordinator.

Four minutes later the wallet sold the USDT through UniswapX (two fills from the Dutch-order reactor 0x00000011F84B9aa48e5f8aA8B9897600006289Be, 851.54 and 1,170.47 ETH), and by 14:19 UTC had moved all 2,022.86 ETH to a distribution wallet, 0x8296721489d0a7E934edd66ea27159B1C88A42e5. That wallet sent 400 ETH to each of four fresh addresses between 14:39 and 14:43 UTC and kept 422.86. On 25 October at 18:00 UTC all five balances were unchanged: 400, 400, 400, 400 and 422.86 ETH, about $4.77 million at $2,357.

The attacker wallet was new. Its first two incoming transfers are 0.021 ETH at 14:05:59 UTC and 0.840 ETH at 14:06:59 UTC, both from 0x4E5B2e1dc63F6b91cb6Cd759936495434C7e972F, a hot wallet that PublicAML’s data attributes to FixedFloat, the instant exchange. The attack transaction followed at 14:11:47 and burned 0.0195 ETH of gas. Nothing else ever funded the wallet. An instant swap with no account is a common way to fund an attack wallet; it also means the exchange holds the record of what was paid in, and from where, to produce that 0.86 ETH.

At 14:35:35 UTC, 24 minutes after the first transaction, a second wallet, 0xfc3fAcD67138966aB0c841E905B0C4BCA1AbE92F, ran the same play against the already-drained Freezer: a 1.95 million USDT flash loan from Morpho, 38,202 X bought, 2 × 19,100 X frozen through two helper contracts, the treasury’s five remaining Uniswap V3 positions burned and 50,000 X sold. The wallet kept 96,381.88 USDT, paid to 0xEDac2D8905bF2Bf0033872D420C4ec6ef1dDd0c8.

This is not a fresh wallet. 0xfc3fAcD67138966aB0c841E905B0C4BCA1AbE92F has 1,928 transactions and was filed by PublicAML on 29 September 2026 as one of the attacker wallets of the Limit Break Payment Processor V2 drain, where it took 10.6 WETH from approved holders. Its gas on 23 October came from the same ChangeNOW deposit address it would cash out to a day later.

The cash-out took twenty minutes. 0xEDac2D8905bF2Bf0033872D420C4ec6ef1dDd0c8 swapped the USDT into about 40.9 ETH through the OKX DEX router at 14:37–14:38 UTC, sent 10 ETH to 0x35DcAbCB77153FD2220FE547D8a8Af4196e0814D at 14:45 and 30.9 ETH to 0x37069ea6a24b754b05B4AD9e7D9923b4eeab99aB at 14:48, and each pass-through forwarded the full amount to 0x3f3Ee0a9cAC2d01DB44001eca3E8382fbe40207B at 14:54 and 14:57 UTC. Etherscan tags that address “ChangeNOW Dep”, and PublicAML’s data holds the same attribution. The profit wallet still holds 9,895 X.

At 14:40:47 UTC a third wallet, 0xDAB137F390dF77caA97fd492540E973fd5e2F8c8, deployed a contract that borrowed 300 USDT from Aave and pulled 549,969 X plus 1,949 USDT out of the Freezer through the same Dackie pool. 549,915 X and 1,909 USDT landed on 0x0A67804462F04B0be1c433fB1C2F7fb76e5166F2, the wallet that had funded 0xDAB137F390dF77caA97fd492540E973fd5e2F8c8 with 0.1 ETH on 1 October. Since then 0x0A67804462F04B0be1c433fB1C2F7fb76e5166F2 has been feeding the X into the Uniswap pool through 1inch limit orders in lots of 1 to 20 tokens for a few USDT each, and still holds almost all of it. At the post-crash price Blockaid cited, under $2, the stack is worth well under $1 million; at the pre-attack price it would have been about $28 million.

It does not say who the attacker is, or that FixedFloat, ChangeNOW, Aave, Morpho, Uniswap, Dackie or OKX did anything wrong: the exchanges received and paid out funds the way they do for anyone, and the lending and swap contracts executed code. It does not say the second and third wallets are the first attacker: they used the same flaw after it was public, and the second one has its own history. The mechanism was first described by Blockaid, ExVul and BlockSec; the four 400 ETH wallets by Chainalysis. The FixedFloat funding, the Limit Break link, the ChangeNOW cash-out, the third wallet and the balances are PublicAML’s own reading of the chain on 25 October 2026.