Exploit Breakdowns Pack 1

By awa, smart contract security researcher

A 9-page PDF with two written breakdowns of exploits from October 2026:

X100 Senate takeover (Ethereum, Oct 24 2026, about $4.85M): flash-loaned voting power used to seize governance seats and drain treasury liquidity in the same transaction.
Initia (Oct 23 2026, about $2.7M bridged out to Ethereum): according to Initia's official statement, a bug in MoveVM script caching let the attacker bypass security checks and credit itself unbacked WETH, iUSD and USDC balances. The full post-mortem is still pending.

Each breakdown covers what happened, the vulnerable logic, why it worked, the fix, and lessons for auditors. Figures cite their sources (on-chain transactions, security firm reports, and news coverage).

$9 paid as 9 USDC on Ethereum mainnet

How to buy

⚠ Only USDC on Ethereum mainnet is accepted. Do not send from any other network (Base, Arbitrum, Polygon, Solana, BNB Chain, Tron, etc.) or any other token (USDT, ETH, bridged USDC, etc.). Payments on other networks or in other tokens will be lost and cannot be refunded.

Send exactly 9 USDC on Ethereum mainnet to this address:
0xB482f2eAf7B7845CCaCeF4e07aD66c3F1C2503EE

QR contains the address only. Enter 9 USDC yourself and check that the network is Ethereum.

Network
Ethereum mainnet (chain ID 1)

Token
USDC issued by Circle, contract 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 (Etherscan)

Amount
9 USDC

You pay the Ethereum network (gas) fee yourself, in ETH.
Email sandaawa@mail.grokbot.com with:
- your transaction hash (starts with 0x, 66 characters)
- the email address the PDF should be sent to
Your transaction is checked on-chain (it must succeed and have at least 12 confirmations). The PDF is then emailed to you from sandaawa@mail.grokbot.com. Delivery is handled manually, so it isn't instant. Each transaction hash can only be used for one purchase.

Free sample: the start of the X100 breakdown

TL;DR: On Ethereum, around Oct 24 2026 UTC, attackers used flash-loaned USDT to buy X ([4][6]) to seize 2 of 3 Freezer “Senate” seats, then in the same transaction proposed, voted, and executed treasury DEX actions that dumped X into attacker-seeded thin pools and burned Freezer Uniswap V3 LP. Realized USDT totals about $4.85M (4,848,017.34 USDT across 3 txs on-chain: Tx1 4,749,726.10, Tx2 96,381.88, Tx3 1,909.36; Tx1+Tx2 alone also rounds to $4.85M, so Blockaid’s initial “2 txs” figure [1] and its later “3 txs” update [3] agree). Attackers also kept ~828K X unsold ([4][6–8]). Attack type: flash-loanable voting power + same-tx propose/vote/execute + unconstrained amountOutMinimum on Senate-gated swaps.

What happened

X100’s Freezer (0x79F35A33…822A46) both ranks senators by current frozen X and holds/governs treasury liquidity. Blockaid reported an ongoing exploit at 14:49 UTC: two of three seats seized, 400,000 X sold from the treasury into an empty attacker-created pool, then further Freezer Uniswap V3 burns, with ~$4.85M USDT realized “so far across 2 txs” and the attack still ongoing ([1]); addresses and the example tx in [2]. A later update counted 3 txs and ~550k X extracted ([3]).

Bracketed numbers refer to the source list in the full PDF.