Two separate attacks on crypto governance systems exposed how voting rules can give newly acquired tokens immediate control over treasury or lending-protocol assets. X100 suffered a loss involving approximately $4.75 million reaching an initial final recipient, while Arkadiko lost an estimated $1.09 million after a malicious contract gained control of vault operations.
According to CryptoSlate, the incidents involved different attack methods but shared a structural weakness: neither protocol created a sufficient gap between acquiring voting power, approving a transaction and allowing that decision to take effect.
X100 attacker used locked tokens to control the Senate
X100 uses a Senate to govern its treasury. Its Freezer contract holds frozen X tokens and ranks Senate candidates according to the amount currently locked. The lock options last one, three or five years, but the governance system did not require the stake to have been frozen for any minimum period before it could be used for Senate eligibility.
On Oct. 24, two helper contracts each froze 19,000.000001 X under the one-year option. They registered as candidates, obtained two of the three Senate seats and supplied the votes needed to approve proposal 7. The registration, voting and execution all occurred in one blockchain transaction.
The approved transaction sent 400,000 treasury X to a pool created by the attacker. The Freezer received only 35.675313 USDT in the swap. The attacker then removed tokens from the pool and sold X to generate the funds needed to repay a flash loan.
The loan was approximately 1.94 million USDT. The principal and premium were repaid in the same transaction, while the X used to obtain Senate power remained locked for a year. About 4.75 million USDT subsequently reached the first final recipient. ChainBounty contributor Philippark reconciled 4.848 million USDT paid to three selected recipients, excluding unsold X and any change in its value.
The Freezer retained a restriction requiring its X balance to cover the amount users had frozen. That protected the locked principal held inside the contract, but it did not protect outside liquidity or the market value of X from the treasury transaction.
Arkadiko vote gave a malicious contract immediate authority
Arkadiko is a lending protocol in which users borrow against collateral stored in vaults. Its proposal 12 was submitted at 20:35 UTC on Oct. 17 and was scheduled around a 720-Bitcoin-block voting period, commonly described as roughly five days. It executed at 16:04 UTC on Oct. 22, two days earlier than the expected end of the stated period.
The governance rules required a proposer to hold 0.25% of eligible DIKO supply, quorum equal to 5% participation and more yes votes than no votes. However, they did not require voters to have held their tokens before the proposal began.
The proposing wallet swapped for about 4.573 million DIKO at 15:03:46 UTC on Oct. 22 and voted three minutes later. The proposal closed with that same yes-vote total and no opposing votes. Bitquery estimated the voting tokens cost roughly $51,000 and found that 77% of the STX sent toward the voting wallet originated from an earlier StackSwap haul.
When the ballot closed, the proposal immediately registered a malicious contract as Arkadiko’s vault-operations contract and granted it minting authority. The contract’s withdrawal and USDA-minting functions did not include caller authorization controls. Within minutes, successful calls removed sBTC at 16:06 UTC and stSTX at 16:09 UTC.
Bitquery estimated the resulting loss at approximately $1.09 million. That included about $780,000 in stSTX, $135,000 in sBTC and $173,000 in STX obtained through the sale of unbacked USDA.
Arkadiko said on Oct. 22 that it had disabled the malicious contract and paused governance, vault redemptions and liquidations. It also said affected stSTX and sBTC vaults could not be modified because the collateral was unavailable. On Oct. 27 at 07:57 UTC, proposal 14 executed and restored the vault-operations entry to Arkadiko’s legitimate v1-3 contract. Restoring that entry, however, does not by itself establish that collateral had been recovered or that users had been compensated.
What the incidents show about governance design
The two attacks highlight separate points of failure. X100 allowed newly frozen tokens to qualify for Senate seats immediately, even though those tokens could not be withdrawn for a year. Arkadiko allowed voting power acquired during an open ballot to determine the outcome, then made the approved change executable without a further waiting period.
Possible safeguards include using voting power from an earlier snapshot, requiring a minimum age for governance stakes and adding a timelock between approval and execution. A delay could create time to respond after a proposal passes, while a historical snapshot could prevent tokens purchased after a vote begins from becoming decisive.
The distinction matters because a long voting period is not necessarily an exit period. Arkadiko’s roughly five-day ballot gave observers advance notice, but the danger became immediately actionable when the vote closed. Similarly, X100’s one-year lock imposed a restriction on withdrawing the stake, but it did not stop that stake from exercising governance authority or prevent the resulting transaction from financing the flash-loan repayment.
Moneyiar market picture
Moneyiar data at the stated times showed mixed performance among the tracked assets:
- Nexus (NEX) was priced at $0.0000006151, up 1.61% over 24 hours but down 13.97% over seven days, as of Oct. 25, 2026, at 22:38 +03:30.
- AKEDO (AKE) stood at $0.031015752, with gains of 0.8% over 24 hours and 2.5% over seven days, as of Oct. 25 at 22:39 +03:30.
- Allora (ALLO) traded at $0.1816716648, down 3.07% in 24 hours and 12.27% over seven days, as of Oct. 25 at 22:39 +03:30.
- Propy (PRO) was $0.3318772943, up 1.7% over 24 hours and down 3.95% over seven days, as of Oct. 25 at 17:19 +03:30.
