X 100 Global’s three-member “Senate” governance body has been compromised, leaving the project facing reported losses of several million dollars. The incident has renewed scrutiny of multisignature governance, concentrated access rights and the security of project funds in the crypto market.
The information currently available indicates that the compromised entity was a three-member governance body rather than an ordinary user account. Because the body handled project decisions or asset-management functions, the takeover of its seats may have affected funds and other critical operating permissions. The exact amount lost, the types of assets transferred, the identity of the attackers and the destination of the funds have not been disclosed.
Three-member governance body at the center of the incident
X 100 Global used a three-seat governance structure modeled on a “Senate.” Such arrangements typically require multiple administrators to approve key actions, limiting the impact of a single account error or compromise. But if a majority or all of the seats, or the related signing permissions, are controlled at the same time, the checks built into a multisignature structure can be undermined.
The central question is whether control of the project’s governance layer was fully taken over and whether the attackers obtained authority to move assets. A change to a governance page, account or voting rights does not by itself prove that all project funds were transferred. The final loss figure will need to be assessed against on-chain transaction records, project disclosures and the balances of affected wallets.
Reported losses of several million dollars remain unverified
Public descriptions of the incident put the losses at “several million dollars,” but no independently verified figure has been provided. For a crypto project, the assessment may include more than tokens transferred directly from wallets. It may also cover liquidity-pool assets, treasury balances, staked positions and subsequent liabilities created by changes to governance permissions.
Market participants are likely to focus on three sets of data: changes in wallet balances before and after the compromise; whether on-chain transfers moved to exchanges or other unidentified addresses; and whether the project can still process withdrawals and execute contract operations normally. Until those details are released, it is difficult for outside observers to determine whether the losses have stopped or whether additional asset transfers remain possible.
Authority controls and user-fund arrangements under scrutiny
X 100 Global will need to clarify the scope of the three governance seats, the timing of the abnormal activity, the contracts and wallets affected, and whether the project has suspended the relevant permissions. If the seats could change treasury addresses, upgrade contracts or adjust fund parameters, the project would also need to disclose whether it froze or revoked access or moved assets to new wallets.
Users are primarily concerned with whether funds can be withdrawn, which assets have been affected and whether the project has finalized its accounting and any compensation arrangements. Information on individual user losses, withdrawal status and the recovery plan remains incomplete. As more wallet addresses and governance records become public, the scale of the incident and the allocation of responsibility should become clearer.