The Daily Ledger: 25 October 2026
How a Flash Loan Governance Attack Works
How a flash loan governance attack works: a borrowed stake won two of X100's three Senate seats and drained about $4.8 million in one transaction. Plus bitcoin below $80,000, Brazil's licensing deadline and a Zcash Sprout warning.
THE DAILY LEDGER
25 October 2026
A flash loan hands an attacker control of X100's treasury, bitcoin dips below $80,000 ahead of the Fed meeting, and Brazil's licensing deadline arrives on Friday.
Reporting window: 24 October 2026, 10:15 UTC to 25 October, 09:40 UTC (10:40 Europe/Stockholm, where clocks went back an hour overnight). Data cutoff: 25 October, 09:40 UTC.
How does a flash loan governance attack work? An attacker borrows enough tokens to win a vote, passes a proposal that pays themselves, and repays the loan, all inside one transaction. That is what happened to X100, an Ethereum project, on 24 October: a borrowed stake bought two of the three seats on its governing "Senate" and drained about $4.8 million.
1. The Day in Numbers
- Bitcoin: $80,152 at 09:39 UTC, down 0.4 percent over 24 hours. CoinGecko.
- Ether: $2,323 at 09:39 UTC, down 1.4 percent over 24 hours. CoinGecko.
- Fear and Greed: 54, Neutral, up from 51. Alternative.me, 25 October, 00:00 UTC.
- Liquidations: more than $810 million of leveraged positions closed in the 24 hours to Saturday afternoon, about $689 million of them bets on rising prices, per CoinGlass data reported by Bitcoin.com. This is a rolling figure, not a daily close.
2. How a flash loan governance attack works
A flash loan is a loan with no collateral that must be repaid before the same transaction ends; if it is not, the whole transaction is cancelled. It costs little, so for a few seconds anyone can hold millions. That is harmless unless a protocol measures power by what you hold right now.
X100 did. According to a Panda Security analysis citing BlockSec, ExVul and Blockaid, its three Senate seats went to the largest frozen (locked) balances at that moment, for a 100 X fee. In one transaction at 14:11:47 UTC, the attacker borrowed about 1.94 million USDT, bought 38,200 X and froze just over 19,000 X in each of two new contracts, outranking two existing members. One seat proposed, the other approved, and the proposal executed in the same call, selling 400,000 treasury X into a near-empty pool the attacker had created for about 36 USDT.
Selling the cheap X netted about 4.75 million USDT; Blockaid counts about 4.85 million across three transactions, and the token fell more than 96 percent. The defences are known: count votes from a snapshot at an earlier block, require a minimum stake age, and add a timelock before execution. X100 had none. As of Saturday afternoon it had made no public statement, and no recovery has been reported.
3. Today's Headlines
Bitcoin dips below $80,000 before the Fed meets
Bitcoin fell to its weakest level in more than a month on Saturday, which CoinDesk linked to reports that the United States is evacuating personnel across the Middle East. The Federal Reserve's next policy meeting runs 27 and 28 October.
Brazil's crypto firms face Friday's licensing deadline
Companies already offering virtual asset services in Brazil must apply for Central Bank authorisation by 30 October under Resolutions 519, 520 and 521, Migalhas reports. Each needs at least three directors answerable to the regulator for areas such as anti-money laundering and cybersecurity.
The UK consults on crypto crime controls
The Financial Conduct Authority opened consultation CP26/38 on its Financial Crime Guide, updating the cryptoasset sections for the regime due in October 2027, alongside sanctions and money laundering controls. Responses close 24 December.
4. Security Note
Zcash's NU7 upgrade activates at block 3,543,405, planned for around 5 November. From then, version 4 transactions are invalid, so ZEC left in the original Sprout shielded pool (addresses beginning "zc") becomes unspendable, possibly for good. The rule: if you hold ZEC from an old wallet, check it now and move any Sprout balance before activation. Never hand a wallet file or seed to a "recovery service" that contacts you first.
5. From the Academy Library
Our lexicon explains how DAOs vote and how oracle manipulation attacks use the same flash loan trick against prices. The DeFi guide covers protocol risk more broadly, and new readers can start at Academy School.
A vote that can be bought and executed in the same second measures liquidity, not consent.
Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.
Sources and further reading
- Etherscan: X100 attack transaction, block 26,263,022
- Panda Security: X100 exploit, a flash-loaned Senate drained $4.75M
- Bitcoin.com News: X 100 Global loses millions as three-seat Senate is hijacked
- Bitcoin.com News: bitcoin price sinks as liquidations rock weekend trading
- CoinDesk: bitcoin slides below $80,000 on U.S. Middle East evacuations, 24 October 2026
- Federal Reserve: FOMC meeting calendar
- Migalhas: virtual asset providers have until 30 October to seek Central Bank authorisation (Portuguese)
- FCA: CP26/38, Financial Crime Guide updates
- Zcash Foundation: Zebra 7.0.0 release, NU7 on Mainnet
- ZIP 259: NU7 deployment
- ZIP 2003: disallowing version 4 transactions
- CoinGecko: bitcoin price
- CoinGecko: ether price
- Alternative.me: Fear and Greed Index