X100 Exploiter launders 821 ETH Through Tornado Cash After $4.75M Hack

The wallet labeled as the X100 exploiter has moved 821.2 ETH, roughly $1.89 million, into Tornado Cash. Blockchain security firm PeckShieldAlert flagged the deposits on October 26, two days after a governance attack that extracted millions from the project.

The numbers come from three separate trackers, and they roughly agree. TraceFast, in an October 26 post on X, reported that wallet 0x8296…42e5 sent 420.8 ETH through 42 deposits of 10 ETH and eight of 0.1 ETH. Another wallet moved 400.4 ETH. Three additional wallets linked to the movement still held about 400.5 ETH each, TraceFast said.

Chainalysis, also posting on October 26, put the mixed funds at more than $1.8 million. Both reports clear that threshold, though the posts don't confirm whether the firms traced exactly the same transactions.

An Etherscan screenshot shows outgoing transfers from an address beginning 0xf637 to Tornado Cash deposit addresses. The list includes a 100 ETH transfer and smaller 0.1 ETH deposits. The wallet held about 0.09 ETH at the time. That alone doesn't tie the address to every transfer TraceFast identified.

One caveat matters here. Tornado Cash obscures the link between deposits and withdrawals. A deposit is not a cash-out. And none of the tracking establishes who is behind the wallets.

How did the attacker take X100's treasury?

Through its own governance, according to an on-chain investigation by analytics firm Bitquery. The attacker used a flash loan — borrowing and repaying assets inside a single transaction — to accumulate enough X tokens to seize two of three seats on X100's Senate, the project's governing body.

Seats went to wallets holding the largest X token balances locked in the Freezer contract. With a voting majority secured, the attacker approved a treasury transaction that sold 400,000 X tokens into an attacker-controlled pool. The treasury received about $35.68 for that sale. The attacker then sold the tokens through a separate liquidity pool, repaid the flash loan, and kept roughly $4.75 million in USDT.

Bitquery's earlier accounting, from an October 25 Chainalysis post, described the same sequence: attackers captured Senate seats, forced the Freezer treasury to sell into an attacker-controlled pool, and extracted approximately $4.7 million in stablecoins across three exploit transactions. Bitquery's broader tally, including later transactions by other wallets, reached roughly $4.85 million plus a substantial haul of X tokens. The two figures don't fully reconcile in the available reports.

What does this change for DeFi governance?

The practical question is why the design failed. X100's governance required no voting snapshot and no timelock between proposal approval and execution. A snapshot freezes voting power at a set point; a timelock delays execution after approval. Both mechanisms block exactly this play — borrowing tokens, voting, and executing before the loan comes due. Projects running token-weighted governance without either control now face an obvious, demonstrated attack path.

A familiar laundering route

The X100 deposits fit an established pattern. On October 21, The Crypto Times reported that a wallet tied to the Drift Protocol exploit deposited 25,700 ETH, about $61.56 million, into Tornado Cash within two hours, per Lookonchain. That wallet still held 81,864 ETH, roughly $195 million. The April 2026 Drift attack caused losses near $295 million.

In June, an address linked to the September 2025 UXLINK breach — a compromised multisig with losses above $44 million — swapped about 14.6 million DAI for 8,298.6 ETH, then deposited 8,340 ETH into the mixer, PeckShieldAlert reported. In April, Arkham traced a wallet linked to Andean Medjedovic, accused by US prosecutors in the KyberSwap and Indexed Finance cases, moving ETH in repeated 100 ETH batches through the same protocol.

No evidence connects these wallets to each other or to the X100 attacker. The identities behind the X100 addresses and the funds' next destinations remain unconfirmed. What's known ends at the mixer's door — and with roughly $1.8 million already inside, investigators and exchange compliance desks will be watching withdrawals in the weeks ahead.