x100global: about $4.8M hack on Ethereum

. Reported by public sources (confirmed by @Phalcon_xyz). Amounts are as reported; the trace below shows what the chain says.

DeFiLlama reported on 2026-10-24 that the x100global protocol on Ethereum lost about $4.8M, and Phalcon_xyz put the estimated loss at $4.75M. CertiK later described the attack as a governance takeover with a loss of about $4.85M, and PeckShield said it was a flash-loan governance attack. KadenaTrace's automatic trace shows about $4.9M moved out of the exploiter address 0x7ec2af…fd63, with about $1,096 still held in traced wallets. Blockaid named that address, and CertiK named 0x829672…42e5 as a second address. According to CertiK, the attacker sent 300 ETH (about $690k) to Tornado Cash, and PeckShield said the labeled exploiter deposited about 821.2 ETH (about $1.89M) into Tornado Cash. Most of the stolen funds appear to have moved into the mixer, and recovery is not reported.

Amount: about $4.8M (reported). Networks: Ethereum.

What is known

Reported
By @Phalcon_xyz, DeFiLlama, @CertiKAlert, @PeckShieldAlert.
Confirmed
Confirmed by @Phalcon_xyz. The amount is as reported.
Recorded on Kadena
As KT-6: each move of the funds is written to a public contract.
Attacker address
1 address attributed by the reports.
Exchange deposits
None seen so far.
Frozen
No freeze read on chain.
Returned
No return of funds recorded here.
Trace coverage
The coverage of this trace was not recorded (traced before Oct 31, 2026); totals are lower bounds until the next refresh.

Addresses attributed to the attacker

Where the funds went

From the trace so far: $4.9M into Tornado Cash; at least $1K still held. A deposit at an exchange is not a freeze or a recovery.

$4.9M followed across 8 addresses so far from 0x7ec2af…8ffd63.

Recorded on Kadena as KT-6: every move of the funds is written to a public contract.

Sources

  • @Phalcon_xyz: ALERT! Our system detected a suspicious transaction targeting @x100global on Ethereum, resulting in an estimated loss of $4.75M. The root cause stems from a gov
  • DeFiLlama
  • @CertiKAlert: 🚨 @x100global attacker is currently sending funds to Tornado Cash: 300 ETH ($690k) has already been sent so far. CertiK Report Security Dashboard 👇
  • @CertiKAlert: 🚨 @x100global attacker is currently sending funds to Tornado Cash: 300 ETH ($690k) has already been sent so far. CertiK Report Security Dashboard 👇
  • @PeckShieldAlert: The address labeled as the X100 exploiter has deposited 821.2 $ETH (~$1.89M) into #TornadoCash. X100 ($X) suffered a flash-loan governance attack on October 24,
  • @CertiKAlert: 🚨 On 24 Oct, X100 was exploited in a governance takeover, resulting in a loss of ~$4.85M. Read our full analysis here👇 CertiK Report Security Dashboard 👇

Timeline

  1. Post cited by the coverage: @CertiKAlert link
  2. 0.4941 ETH moved to Tornado Cash (hop 3) transaction
  3. 0.494 ETH moved to Tornado Cash (hop 3) transaction
  4. 0.494 ETH moved to Tornado Cash (hop 3) transaction
  5. Post cited by the coverage: @PeckShieldAlert link
  6. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  7. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  8. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  9. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  10. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  11. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  12. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  13. 0.1 ETH moved to Tornado Cash (hop 2) transaction
  14. 10 ETH moved to Tornado Cash (hop 2) transaction
  15. 10 ETH moved to Tornado Cash (hop 2) transaction
  16. 10 ETH moved to Tornado Cash (hop 2) transaction
  17. 10 ETH moved to Tornado Cash (hop 2) transaction
  18. 10 ETH moved to Tornado Cash (hop 2) transaction
  19. 10 ETH moved to Tornado Cash (hop 2) transaction
  20. 10 ETH moved to Tornado Cash (hop 2) transaction
  21. 10 ETH moved to Tornado Cash (hop 2) transaction
  22. 10 ETH moved to Tornado Cash (hop 2) transaction
  23. 10 ETH moved to Tornado Cash (hop 2) transaction
  24. 10 ETH moved to Tornado Cash (hop 2) transaction
  25. 10 ETH moved to Tornado Cash (hop 2) transaction

Read: How to trace stolen crypto, hop by hop.

Facts about addresses and transactions, never about people. Trace a wallet · Check an address · All live incidents