Attackers exploited governance vulnerabilities in two DeFi projects, X100 and Arkadiko, between October 22 and 24, draining approximately $6 million in combined losses through flash loans and manipulated voting mechanisms, blockchain security analysts report.
On October 24, an attacker acquired two governance seats on X100, a token project with a Senate-governed treasury, by freezing tokens under one-year lock terms and immediately using them to vote and execute a treasury swap, all in a single blockchain transaction. The approved transaction sent 400,000 treasury X tokens into an attacker-controlled pool, from which the attacker extracted funds to repay a flash loan of about 1.94 million USDT, netting approximately 4.75 million USDT to the final recipient. ChainBounty contributor Philippark reconciled 4.848 million USDT paid to three selected recipients, excluding unsold X and its changing value.
In a separate incident on Arkadiko, a lending protocol, proposal 12 was submitted on October 17 and executed on October 22. The attacker purchased voting tokens shortly before the vote closed, committing about 4.573 million DIKO. The proposal, which passed without opposition, registered a malicious contract as the vault-operations contract with mint permission. The attacker then withdrew approximately $1.09 million in assets, including stSTX, sBTC, and STX from selling unbacked USDA, within minutes of activation.
Arkadiko disabled the malicious contract and paused governance, vault redemptions, and liquidations on October 22. On October 27, proposal 14 restored vault operations to the legitimate contract.
Both incidents highlight governance design flaws: X100's lock terms did not require a minimum stake age for Senate eligibility, while Arkadiko's ballot allowed late token purchases to become immediately usable voting power with no separate execution delay. Security researchers note that requiring older stake or introducing an execution timelock could have prevented these attacks.
Analysis
Why This Matters
- DeFi governance attacks are growing more sophisticated, exploiting timing gaps between token acquisition, voting, and execution
- The combined $6M loss underscores the need for stronger guardrails in on-chain governance systems
- These incidents may prompt projects to adopt timelocks and snapshot-based voting to prevent rapid exploitation
Background
Decentralized finance protocols often use token-based governance where holders vote on proposals to change protocol parameters. Flash loans allow attackers to borrow large sums without collateral, provided the loan is repaid in the same transaction. The X100 and Arkadiko attacks exploited the absence of a mandatory waiting period between vote approval and execution, allowing attackers to act immediately after gaining voting power.
Key Perspectives
X100's attacker: exploited the lack of minimum stake age by freezing tokens under one-year lock terms and immediately using them to gain Senate seats and execute a treasury swap, all in one transaction.
Arkadiko's attacker: purchased voting tokens just before the vote closed on an already-open ballot, then used the approved malicious contract to drain vault assets minutes after activation.
Arkadiko's response team: disabled the malicious contract and paused governance, vault redemptions, and liquidations on October 22, then restored vault operations via proposal 14 on October 27.
ChainBounty contributor Philippark: reconciled the funds paid from the X100 attack, totaling 4.848 million USDT to three selected recipients.
What to Watch
- Whether X100 or Arkadiko announce compensation plans for affected users
- Possible adoption of execution timelocks by other DeFi protocols
- Regulatory scrutiny of flash loan exploits and governance vulnerabilities
Checked
12 claims in this story checked against 1 source: 8 supported.
Show each claim
- Partly supportedThe headline says the roughly $6 million loss came from multiple flash-loan attacks.CryptoSlate: “The attacker committed funds across multiple transactions and dates, so Arkadiko’s case differs materially from X100’s single-transaction borrowing and repayment.”
- Partly supportedThe summary says both incidents allowed attackers to drain treasuries.CryptoSlate: “The approved swap sent 400,000 treasury X into an attacker-created pool.”
- SupportedThe incidents occurred between October 22 and 24 and caused about $6 million in combined losses.CryptoSlate: “An attacker still acquired two governance seats on X100, a token project with a Senate-governed treasury, and approved a treasury transaction and repaid a flash loan in a single blockchain transaction on Oct. 24. At Arkadiko, a lending protocol”
- Not in the sourcesBlockchain security analysts reported the opening account.CryptoSlate: “The incidents expose different gaps between committing money, qualifying to vote, and executing an approved action.”
- SupportedOn October 24, the X100 attacker gained two Senate seats by freezing tokens under one-year terms and used them to vote and execute in one transaction.CryptoSlate: “In the first Oct. 24 attack, two helper contracts each froze 19,000.000001 X under the one-year term. They registered, entered the ranking, and supplied the two supporting votes that executed proposal 7. They completed the stake, votes, and execution in a single transaction.”
- SupportedThe X100 swap sent 400,000 treasury X to an attacker-created pool; the attacker borrowed about 1.94 million USDT and about 4.75 million USDT reached the first final recipient.CryptoSlate: “The approved swap sent 400,000 treasury X into an attacker-created pool. […] The attack borrowed about 1.94 million USDT and repaid the principal plus its premium. After repayment, about 4.75 million USDT reached the first final recipient.”
- SupportedChainBounty contributor Philippark reconciled 4.848 million USDT paid to three selected recipients, excluding unsold X and its changing value.CryptoSlate: “ChainBounty contributor Philippark reconciled 4.848 million USDT paid to three selected recipients. That subtotal excludes unsold X and its changing value, measuring selected payments.”
- SupportedArkadiko proposal 12 was submitted on October 17 and executed on October 22; the attacker committed about 4.573 million DIKO shortly before the vote closed.CryptoSlate: “Arkadiko’s proposal 12 was submitted at 20:35 UTC on Oct. 17 and executed at 16:04 UTC on Oct. 22. […] The proposing wallet made a swap at 15:03:46 UTC on Oct. 22 and a vote at 15:06:47. It committed about 4.573 million DIKO.”
- SupportedProposal 12 passed without opposition and registered a malicious contract as the vault-operations contract with mint permission.CryptoSlate: “The proposal closed with the same yes-vote total and zero no votes. […] Proposal 12 registered it as the vault-operations contract with mint permission.”
- SupportedThe Arkadiko attacker withdrew about $1.09 million in assets, including stSTX, sBTC and STX from selling unbacked USDA, within minutes of activation.CryptoSlate: “Successful calls removed sBTC at 16:06 UTC and stSTX at 16:09, minutes after activation. Bitquery estimates Arkadiko’s loss at about $1.09 million: roughly $780,000 of stSTX, $135,000 of sBTC and $173,000 of STX obtained by selling unbacked USDA.”
- SupportedArkadiko disabled the malicious contract and paused governance, vault redemptions and liquidations on October 22; proposal 14 restored vault operations on October 27.CryptoSlate: “In its Oct. 22 response thread, Arkadiko said it had disabled the malicious contract and paused governance, vault redemptions and liquidations. […] At 07:57 UTC on Oct. 27, proposal 14, “AIP 32.2 – Restore Vault Operations,” executed”
- Partly supportedSecurity researchers said that requiring older stake or adding an execution timelock could have prevented the attacks.CryptoSlate: “Requiring an older stake or using voting power from an earlier snapshot could have prevented the newly acquired tokens from qualifying immediately, while an execution delay would have separated approval from asset movement.”
