Key Highlights:
- A third attacker exploited the same governance mechanism to drain approximately 550,000 X tokens in remaining liquidity from Uniswap V3.
- Across three separate operations, malicious actors have siphoned roughly 4.85 million USDT alongside 550,000 X tokens.
- According to cybersecurity firm Blockaid, the exploit remains active, with about 12.2 million X tokens still stored inside the protocol’s Freezer contract.
Governance Flaw Enables Multi-Stage Protocol Exploit
Blockchain security firm Blockaid has reported an ongoing security incident involving the systematic exploitation of a protocol’s governance mechanism. In a recent update, the security company disclosed that a third attacker leveraged the compromised governance structure to target decentralized exchange liquidity, specifically extracting roughly 550,000 X tokens from Uniswap V3.
The latest withdrawal marks an extension of an attack vector that has systematically eroded liquidity across multiple phases. By manipulating or exploiting the protocol’s internal governance pathways, the entities behind the coordinated operations have circumvented intended access controls to access and siphon locked digital assets.
Total Losses Climb Past $4.85 Million USDT
Cumulatively, the three linked malicious operations have inflicted severe financial damage on the targeted system. According to findings published by Blockaid, the attackers have successfully seized approximately 4.85 million USDT in stablecoin reserves. In addition to the multi-million-dollar stablecoin drainage, the bad actors pulled the additional 550,000 X tokens from the Uniswap V3 pool, significantly reducing protocol-backed market depth.
The multi-stage nature of the theft demonstrates repeated abuse of the vulnerable governance structure. Instead of a single localized event, multiple coordinated or successive unauthorized transactions were executed using identical operational methods to extract value.
Ongoing Threat to Millions of Locked X Tokens
The cybersecurity firm warned that the vulnerability has not yet been neutralized and that the incident remains an active threat. Based on Blockaid’s analysis, approximately 12.2 million X tokens continue to reside inside the protocol’s Freezer contract, presenting a critical ongoing risk should the governance mechanism remain compromised or accessible to unauthorized actors.
Security analysts continue to monitor the affected addresses and smart contracts while the status of the remaining funds in the Freezer contract hangs in the balance.
Why This Matters
Governance mechanisms are designed to decentralize operational decision-making, voting rights, and protocol upgrades. However, when architectural vulnerabilities or logic flaws exist within administrative smart contracts, these systems can become direct attack vectors. This exploit underscores the severe risks associated with governance security, demonstrating how repeated execution of malicious proposals or permissions can systematically drain treasury assets, deplete decentralized exchange liquidity on platforms like Uniswap V3, and jeopardize millions of tokens held in secondary storage contracts.
Frequently Asked Questions
How much has been stolen in the exploit so far?
Across three operations, the attackers have seized approximately 4.85 million USDT and withdrawn 550,000 X tokens from Uniswap V3 liquidity.
Is the exploit still active?
Yes. Cybersecurity firm Blockaid confirmed that the attack is ongoing, with approximately 12.2 million X tokens remaining at risk inside the protocol’s Freezer contract.
What mechanism was used to execute the theft?
The perpetrators utilized the protocol’s own governance mechanism across three separate phases to access funds and withdraw liquidity.
