UXLink Exploiter lose most trades on stolen ETH. Credit: Getty Images.
Share
Key Takeaways
The UXLink hacker made repeated high-risk trades instead of safely cashing out stolen funds.
Positions were often held through losses, with exits near breakeven.
The exploit generated over $30 million in ETH, much of which was actively traded.
The hacker behind the massive UXLink breach has turned out to be surprisingly bad at trading.
After stealing tens of millions in cryptocurrency last year, the exploiter spent the past six months actively flipping the stolen ETH and other assets on decentralized exchanges.
According to blockchain intelligence firm Arkham, the results haven’t been great.
The hacker racked up repeated losses along the way and has only recently managed to crawl back to roughly breakeven.
Try Our Recommended Crypto Exchanges
Sponsored
Disclosure
We sometimes use affiliate links in our content, when clicking on those we might receive a commission at no extra cost to you. By using this website you agree to our terms and conditions and privacy policy.
One snapshot reveals nearly 625 individual transactions, with frequent swaps between ETH and DAI using platforms like CoW Swap.
UXLink explorer trading activity. Credit: Arkham.
The strategy, if it can be called that, followed a pattern.
The exploiter often bought into dips, held through volatility, and watched positions slide into losses before exiting—usually only once prices recovered close to breakeven.
UXLink exploiter’s profit loss chart. Credit: Arkham.
Arkham’s profit-and-loss data highlights the outcome.
At multiple points between October 2025 and early 2026, the wallet sat as much as $4 million in the red.
Despite continued trading, there were no sustained gains beyond the original stolen funds.
How the Exploit Unfolded
The story began in September 2025, when the attacker exploited a smart contract vulnerability in UXLink, an AI-powered Web3 social platform.
The breach allowed the exploiter to take control of a multi-signature wallet and drain roughly $11.3 million in assets.
The haul included $4 million in USDT, $500,000 in USDC, $3.7 million in wrapped Bitcoin, and smaller amounts of ETH.
The attack didn’t stop there.
The hacker also minted billions of UXLINK tokens and distributed them across decentralized markets, generating an additional $28 million in ETH.
In total, the exploit produced between $30 million and $40 million, though some funds were later lost in a secondary phishing incident.
At first, the exit looked clean. Funds were split across dozens of wallets and converted into ETH and stablecoins.
But instead of disappearing, the exploiter stayed active.
Experts Say Exploiters are Bad at Trading
On-chain watchers say this kind of behavior is common among exploiters who treat stolen funds as personal trading accounts.
Most exploiters launder stolen funds through mixers and exit after paying significant trading fees.
However, the UXLink attacker kept playing the market instead.
Arkham described the entity as both a hacker and a DAI whale, noting repeated attempts to chase profits that never materialized.
A Brief Recovery—Then Back to Neutral
One of the few successful trades came when the exploiter sold 5,496 ETH—worth about $11.8 million—through CoW Swap, converting it into DAI.
That move generated a profit of roughly $935,000 and temporarily lifted the overall portfolio back to breakeven.
Even so, the broader picture hasn’t changed much.
Current holdings sit at approximately $36.6 million, closely aligned with the post-exploit value after market fluctuations.
The wallet includes around $22.3 million in DAI, 202.77 wrapped Bitcoin worth about $14.27 million, and smaller token positions.
Prashant Jha is a seasoned crypto journalist based in Delhi, India, with a Bachelor’s Degree in Computer Science Engineering. Passionate about the evolving world of blockchain and cryptocurrencies, he has been a dedicated voice in the industry since 2018. Prashant’s expertise lies in regulatory reporting, where he unravels complex legal and financial developments with clarity and precision. Before joining CCN in 2024, he honed his craft at Cointelegraph, establishing himself as a trusted name in crypto journalism.
His coverage spans major industry events, including the high-profile collapses of FTX, Three Arrows Capital (3AC), and LUNA, offering readers insightful analyses of their regulatory and market implications. Prashant’s technical background enables him to bridge the gap between intricate blockchain technology and its real-world applications, making his work accessible to novices and experts.
Beyond his professional pursuits, Prashant is an avid music enthusiast, often exploring diverse genres to unwind. A sports lover, he has a particular passion for cricket and frequently engages in discussions about the game. His multifaceted interests and sharp journalistic instincts make him a valuable contributor to CCN, where he continues shaping the crypto landscape's narrative.
