On September 23, the decentralized social project UXLINK was suddenly attacked by hackers. The attackers tampered with the multi-signature permissions and stole more than $11 million in assets. They then took control of the minting rights and issued an additional 1 billion UXLINK on the chain. Once the news was released, UXLINK fell nearly 65% overnight and was quoted at $0.1 as of press time.
UXLINK officials responded quickly after the attack, stating that most of the funds stolen by the hackers have been frozen, and that they are working with security firms to recover the stolen funds and will initiate a token swap. The following is a key timeline of the incident and follow-up observations. BlockBeats will continue to monitor and provide real-time updates:
September 23
11:48｜UXLINK hackers may have been targeted by Inferno Drainer phishing attack
SlowMist founder Yu Xian tweeted that the UXLINK hackers may have been targeted by an Inferno Drainer phishing attack. "The approximately 542 million UXLINK previously stolen may have been siphoned off by Inferno Drainer using standard authorization phishing techniques."
11:13｜Disposal plan: Token swap will be initiated
UXLINK has officially detected the continued unauthorized minting of UXLINK tokens by malicious actors. UXLINK is urgently contacting exchanges to suspend token deposits and trading and initiate a token swap. Further details and instructions regarding the token swap will be released soon. The team emphasized that no individual user wallets were affected by this incident. UXLINK has pledged to compensate affected users with tokens and has begun strengthening security measures, including upgrading its multi-signature wallet mechanism and introducing hardware wallets for asset storage.
11:04｜Paidun Security Tip: Do not interact
According to Paidun monitoring, since today's UXLINK hacker has obtained minting rights, and 1 billion UXLINK tokens have just been minted on Arbitrum, the tokens have now been leaked. Users are reminded not to interact with UXLINK tokens.
11:01 | Exchange Risk Control: Upbit Alert & Suspends Deposits
According to an official announcement, Upbit has designated UXLINK as a trading alert token. Deposits for UXLINK have been suspended, and the resumption of deposit services will be announced later, following the procedures for designating a token as a trading alert.
The announcement stated that Upbit has discovered numerous flaws in UXLINK, posing potential risks to users. The reasons for this are as follows: Based on best practices supporting virtual asset trading, there have been security incidents such as hacker attacks, and the issuer or operator has failed to disclose material information about the virtual asset in a timely manner through appropriate electronic media. Therefore, Upbit has designated UXLINK as a trading warning asset to protect investors.
Trading warning period: Tuesday, September 23, 2025, 12:00 PM (KST) - Friday, October 17, 2025, 11:59 AM (KST)
09:53｜Hacker's additional issuance exposed: 1 billion UXLINK
According to market news, the hacker chain has issued an additional 1 billion UXLINK.
09:44｜UXLINK: Freeze Progress & Compensation Plan
Officials said that in the past few hours, they have been working closely with major trading platforms, most of the stolen assets have been frozen, and collaboration with the trading platforms is still ongoing.
UXLINK's top priority is ensuring the security of community assets and maximizing asset recovery. We have engaged Pidun to support the ongoing investigation and strengthen recovery efforts. Currently, there is no indication that individual user wallets have been compromised. The next step is to develop a clear plan to restore and compensate affected accounts. Protecting the interests of the community remains UXLINK's highest priority, and we will continue to share verified progress updates.
09:08｜Officials confirmed the attack, attempted to freeze suspicious deposits and report the incident to the police
UXLINK has officially announced the discovery of a security vulnerability involving its multi-signature wallet, which resulted in a significant amount of cryptocurrency being illegally transferred to CEXes and DEXes. The team is working with security experts to investigate the cause and contain the situation. They have contacted the exchange to freeze the suspected UXLINK deposits and have filed a report with the police and relevant authorities to facilitate legal action and asset recovery.
00:49｜Preliminary report: Suspected attack, losses exceed $11 million
Cyvers detected approximately $11.3 million in suspicious transactions related to UXLINK. The attacking address removed administrator privileges via delegateCall and called addOwnerWithThreshold, transferring 4 million USDT, 500,000 USDC, 3.7 WBTC, and 25 ETH. USDT/USDC were exchanged for DAI on Ethereum, and USDT was exchanged for ETH on Arbitrum and then back to Ethereum. Subsequently, the related address received 10 million UXLINK (approximately $3 million) and began exchanging them.
Click here to learn about BlockBeats' BlockBeats job openings
Welcome to join the BlockBeats official community:
Telegram group: https://t.me/theblockbeats
Telegram group: https://t.me/BlockBeats_App
Official Twitter account: https://twitter.com/BlockBeatsAsia
