how to research a crypto token with ai: the $4.7m x100 case

daily ai × crypto news in 5 minutes. no hype, just what matters.

updated oct 25, 2026

morning. it's sunday, so this is the case of the week: how to research a crypto token with ai before you put a dollar in, using free or cheap tools, in about 10 minutes. this week's case is a perfect teacher. on friday, one ethereum transaction borrowed ~$1.94m, used part of it to grab 2 of the 3 seats on x100's on-chain "senate," voted to dump the treasury, repaid the loan and kept about 4.75 million usdt. no code was "hacked." the rules allowed it, and anyone who read them could have seen it. below: the 7-step check, the exact ai prompt, what it costs, and what it can't catch. then the week in 60 seconds.

here's what the receipt of transaction 0x38c608… shows, per le coin's read of the on-chain logs. at 14:11:47 utc on oct 24, a contract took a flash loan of about 1,942,457 usdt. it bought ~38,200 x tokens, split them across two helper wallets, and locked ~19,000 each into x100's "freezer" contract, which made both wallets senators: 2 of 3 seats. in the same transaction they proposed, voted and executed a sale of 400,000 treasury x into an attacker-made pool, for about 35.68 usdt. after more swaps, the loan was repaid and ~4,749,726 usdt went to the attacker. the proposal text on-chain literally read "testnet flash governance proof." the defiant puts the total at 4.85m usdt across two transactions. (le coin, the defiant, etherscan)

what was missing: two boring, standard safeguards. a voting-power snapshot taken before a proposal (so tokens bought in the same block don't count), and a timelock between a passed vote and execution (so people can see a bad proposal coming). x100 had neither in the path. you don't need to read solidity to spot that. you need to ask the right question, and an ai can help you ask it.

total: $0 to $20 a month. time: ~10 minutes per token once you've done it twice.

1. pin the real contract address. copy it from the project's official site or docs, then cross-check on coingecko. copycat tokens reuse names and tickers. paste the address into the explorer and confirm the source code is "verified." unverified code = you can't check anything below, which is itself the answer.

2. run the scam scanners. drop the address into token sniffer and honeypot.is. together they look for the classic traps: you can buy but not sell, hidden sell taxes, an owner who can mint unlimited supply. treat a clean result as "no obvious trap," not "safe." honeypot.is says it plainly: "just because it's not a honeypot now, does not mean it won't change!" and note: neither scanner would flag x100's problem. it lived in the governance design, not in a trap function.

3. ask the ai to read the contract for you. copy the verified source from the explorer's "contract" tab into claude or chatgpt with a prompt like this:

on x100-style rules, a good answer is a red flag in one line: "voting power is counted at execution time and there is no timelock." that's the whole exploit. if the contract is a proxy (upgradeable), ask the ai to read the implementation too, and remember the code can be swapped later. a reminder from our php2shell issue: ai is great at reading code and also great at sounding sure. make it quote function names, then search for them yourself.

4. map who holds the supply. open the token in bubblemaps. you're looking for clusters: groups of wallets funded from the same source, which often means one team or insider controls far more than the holder list suggests. bubblemaps' hawk write-up shows why: at launch, 96% of the supply sat in one connected cluster, and presale wallets sold $3.3m into a pool holding just 3% of supply. the explorer's "holders" tab gives you the raw top-holder list; ask the ai which of those are exchanges, burn addresses or contracts. we covered labeling big wallets in the whale-tracking case. (bubblemaps)

5. check liquidity and real usage. on defillama, look up the protocol's tvl, fees and revenue. thin liquidity means your own sell moves the price. x100's attacker dumped 400,000 tokens into a pool it controlled and got ~$36 for them: pools can be nearly empty. then compare market cap to fdv. a big gap means a lot of tokens still waiting to unlock and be sold.

6. follow the keys and the votes. who can change things, and how fast? on the explorer, check whether the owner is a single wallet or a multisig, and read recent admin transactions. for governance tokens, ask: how many votes does it take to move the treasury, and could that many be bought for less than the treasury holds? at x100, ~38,200 tokens bought 2 of 3 seats guarding millions. that ratio is the tell.

7. get a one-page verdict, then argue with it. paste your notes from steps 1–6 into the ai and ask for (a) a one-paragraph summary, (b) the three biggest risks ranked, and (c) "the strongest case for staying away." if you can't explain in two sentences what stops an insider from draining it, you have your answer. this is research, not a buy signal.

more step-by-step guides in cases, and every tool above lives in the gweiwire tools catalog.

token sniffer: paste a token address and get "automated scam detection, contract auditing, and risk analysis" in one score, from the solidus labs team. free to use. for anyone about to buy a token they found on social media; run it first, then do steps 3–7. more picks in the tools catalog.

that's the wire. the rules are the risk. read them before you buy. back tomorrow. — gweiwire

forward this to the friend who apes into every new ticker. new here? subscribe at gweiwire.com. not financial advice.