Blockchain security firm Blockaid reported that malicious activity targeting the X100 protocol continued following the initial treasury drain on October 24, 2026

Overview Debates Related claims Topics Sources

The SP1 soundness flaw affected native Rust verification in sp1_hypercube, sp1_prover, and sp1_sdk versions 6.0.0 through 6.8.0

A high-severity soundness bug in Succinct's SP1 zero-knowledge proving system exposed Succinct's mainnet Prover Network to invalid execution proofs from third-party provers

Security firm Blockaid warned that the X100 governance takeover attack launched on October 24, 2026 on the Ethereum network was ongoing

The X100 protocol governance takeover attack on October 24, 2026 targeted assets held on the Ethereum blockchain, liquidating liquidity pools and treasury reserves

Succinct deployed the version 6.8.1 patch for SP1's soundness bug to the mainnet Prover Network, requiring no configuration changes from users requesting network proofs

An attacker could exploit SP1 by supplying proof data with mismatched size labels, causing the native Rust verifier to accept an invalid proof

Succinct stated in GitHub security advisory GHSA-p7v2-jjv3-8p8f that its mainnet Prover Network was the only known deployment affected by a high-severity soundness bug in SP1's proving system

Succinct advised users running native Rust verifiers in SP1 who accept proofs from untrusted provers to upgrade their software to version 6.8.1

Succinct released version 6.8.1, which patched a high-severity soundness bug in SP1, on September 24, 2026, 17 days before publishing GitHub security advisory GHSA-p7v2-jjv3-8p8f on October 11, 2026

The conversion of stolen USDT into ether following the X100 exploit was carried out shortly after the X100 protocol treasury tokens were drained on October 24, 2026

The X100 protocol exploit on October 24, 2026 was executed in two transactions that converted X100 protocol treasury tokens and liquidity positions into USDT

The primary exploiter in the X100 protocol governance takeover attack on October 24, 2026 converted approximately 4.75 million USDT into ether

The proceeds from the X100 protocol exploit on October 24, 2026 were split across four wallets, with a distribution wallet retaining an additional 423 ETH

After swapping USDT into ether, the X100 attacker in the October 24, 2026 governance takeover initiated wallet transfers to disperse the stolen funds across multiple Ethereum addresses

Hardware wallet manufacturer Trezor disclosed a customer data breach in August 2026 caused by unauthorized access at its third-party logistics provider, ShipMonk

Following the unauthorized access to its website on October 20, 2026, Keystone Hardware Wallet blocked unauthorized access, patched the website vulnerability, and began notifying customers affected by the breach via email

Keystone Hardware Wallet confirmed on October 23, 2026, after reviewing API activity with Shopify, that a third party had obtained customer data

The third-party access to Keystone Hardware Wallet's official website on October 20, 2026, specifically resulted in unauthorized access to customer shipping information held by the company

The October 20, 2026 website breach at Keystone Hardware Wallet exposed customer names, contact details, shipping addresses, and order details including items purchased and prices

Keystone Hardware Wallet initiated an investigation into the October 20, 2026 website breach and announced plans to release a detailed investigation report in subsequent days