X100 ran its treasury through a three-seat "Senate." Seats went to the biggest frozen balances. Someone froze 19,000.000001 X.
Per ExVul, anyone could apply for the Senate instantly for a 100 X fee. No voting snapshot, no stake-age delay, no timelock. Two helper wallets each froze 19,000.000001 X, edging out the 19,000 X incumbent by one raw unit, and took 2 of 3 seats.
Proposal #7 then passed and executed in the same transaction: sell 400,000 treasury X into an attacker-seeded pool, minimum output zero. The treasury got about 35.68 USDT for it. Blockaid counts ~$4.85M USDT realized across the first two transactions, plus ~550,000 X pulled in a third, and called the attack ongoing as of 10:49 a.m. ET.
The governance worked exactly as written. That was the exploit.
Source: ExVul on X