Why the UXLINK hacker’s 14,336 ETH transfers raise fresh questions for DeFi

ambcryptoPublished on 2026-07-05Last updated on 2026-07-05

Abstract

Recent on-chain activity reveals the UXLINK exploiter is actively laundering stolen funds, complicating tracing efforts. The September 2025 hack, which exploited a 'delegateCall' vulnerability to steal roughly $4.5 million, involved converting illicit assets into DAI and Ethereum. Recently, the attacker swapped over 10 million DAI for approximately 6,000.8 ETH and has deposited a total of 14,336.6 ETH into the privacy mixer Tornado Cash in recent weeks, including over $8.1 million worth in a single move. Simultaneously, wallets connected to the defunct Mining Express Ponzi scheme have been converting long-held assets, swapping 5,004 ETH for 8.8 million DAI. Following a separate exploit of the Jaredfromsubway.eth MEV bot, about $5.1 million was also routed to Tornado Cash. These incidents underscore a critical vulnerability in DeFi: while enabling permissionless transfers, the ecosystem lacks effective mechanisms to halt or manage illicit funds once in motion, allowing them to be moved and concealed relatively easily. This highlights the need for strengthened cross-network coordination and real-time threat detection to better safeguard the space.

Recent on‐chain activity shows the UXLINK exploiter actively laundering stolen funds to make them harder to trace.

For background, the UXLINK exploit occurred in September 2025. At the time, the hackers took over the project’s multisignature wallet by taking advantage of a ‘delegateCall’ vulnerability.

They created billions of illegal UXLINK tokens, draining about $4.5 million in cryptocurrency assets. The stolen money was then transferred between several wallets and exchanged for DAI (a stablecoin that is pegged to the U.S. dollar) and Ethereum [ETH].

UXLINK exploiter launders stolen funds

After the attack, the hacker exchanged the remaining DAI tokens for about 6,000.8 ETH.

Source: PeckShieldAlert/X

Following which, the exploiter immediately deposited 6,038 ETH into Tornado Cash following the swap. In fact, in the past two weeks, the attacker has deposited 14,336.6 ETH into Tornado Cash.

Most recently, the attacker laundered stolen assets by converting millions of DAI into ETH and depositing more than $8.1 million worth of ETH into Tornado Cash.

Mining Express faces a similar issue

At the same time, wallets associated with the defunct Mining Express scheme appear to be reallocating long-held assets. The wallet linked to the purported Ponzi scheme changed its holdings into a more liquid stablecoin by exchanging 5,004 ETH for 8.8 million DAI.

For context, Kaze Fuziyama founded Mining Express in 2019. Back then the company allegedly deceived investors with an MLM-based cryptocurrency mining scheme. Soon after that, the company went bankrupt, which pushed the Ukrainian authorities for further investigation in 2022.

Source: Specter/X

After receiving 4,512 ETH in 2024, the associated wallet staked funds via Lido and Ether.fi before fully unstaking them in May 2026. More recently, about $5.1 million of the $7.5 million was moved to Tornado Cash following the exploitation of the Jaredfromsubway.eth MEV bot.

Where is the gap?

It’s evident that although the ecosystem facilitates smooth, permissionless asset transfers, it still lacks efficient systems to stop or deal with illegal funds once they are in motion. In fact, once illegal funds are in the DeFi ecosystem, it is still relatively easy to move and hide them.

Therefore, to safeguard decentralization and user privacy, protocols must strengthen cross‐network coordination and implement real‐time threat detection.

Final Summary

  • The UXLINK reportedly swapped the remaining 10.54 million DAI for 6,000.8 ETH, and a wallet linked to Mining Express swapped 5,004 ETH for 8.8 million DAI.
  • These, along with other exploits and money laundering, reveal a significant crack in the DeFi ecosystem.

Trending Cryptos

ctr
CitreaCTR
wstusdt
wrapped stUSDTWSTUSDT
apr
aPrioriAPR
ctx
Cryptex FinanceCTX
audio
AudiusAUDIO
mantra
MantraMANTRA
xvs
VenusXVS
waxl
AxelarWAXL
bill
Billions NetworkBILL
pyth
PYTH (Pyth)PYTH
rune
THORChainRUNE
brev
BrevisBREV
cake
PancakeSwapCAKE
jst
JUSTJST
band
Band ProtocolBAND

Related Questions

QWhat vulnerability did the hackers exploit to carry out the UXLINK attack in September 2025?

AThe hackers took advantage of a 'delegateCall' vulnerability to take over the project's multisignature wallet.

QHow did the UXLINK exploiter launder the stolen funds, and what tool was primarily used?

AThe exploiter laundered the funds by converting stolen DAI into ETH and then depositing the ETH into the privacy mixer Tornado Cash. Over two weeks, they deposited 14,336.6 ETH into Tornado Cash.

QWhat was the Mining Express scheme, and how are its associated wallets currently moving assets?

AMining Express was an MLM-based cryptocurrency mining Ponzi scheme founded in 2019. Associated wallets are now reallocating long-held assets, such as swapping 5,004 ETH for 8.8 million DAI and moving funds to Tornado Cash.

QWhat key problem in the DeFi ecosystem does the article highlight based on these incidents?

AThe article highlights that while DeFi facilitates permissionless transfers, it lacks efficient systems to stop or deal with illegal funds once they are in motion, making it relatively easy to move and hide stolen assets.

QWhat solutions does the article suggest to address the vulnerabilities exposed by these exploits?

AThe article suggests that protocols must strengthen cross-network coordination and implement real-time threat detection to safeguard decentralization and user privacy.

Related Reads

OUSD, Which Caused Circle to Plunge 17% Overnight, Is Mired in Marketing Controversy

On June 30th, Open Standard announced the upcoming launch of Open USD (OUSD), a new stablecoin promising features like free minting/burning, yield sharing, and shared governance by a coalition of over 140 partners, including major names like Western Union, Ripple, and MetaMask. This news caused a 17.55% drop in Circle's stock price. However, the announcement quickly faced controversy. Several listed companies, including Samsung Electronics and Dunamu (Upbit's parent), denied formal agreements, stating they were only approached for initial discussions. Critics accused Open Standard of "legitimacy-borrowing"—inflating its partner list for marketing. Circle CEO Jeremy Allaire publicly questioned OUSD's sustainability, arguing that free transactions and full revenue sharing might underfund critical infrastructure, and that multi-company governance often scales poorly. Despite the backlash, some firms like Stripe and Coinbase confirmed support, with Stripe planning to set OUSD as a default stable币 for businesses. The incident has cast an early shadow of skepticism over OUSD's launch.

Foresight News3m ago

OUSD, Which Caused Circle to Plunge 17% Overnight, Is Mired in Marketing Controversy

Foresight News3m ago

A Decade of Change: The Demise of Crypto Startups

"The Decade-Long Transformation: The Demise of Crypto Startups" The article traces the dramatic evolution of the cryptocurrency industry from its anarchic beginnings to its current highly regulated and institutionalized state. In the early days (circa 2017), launching a crypto startup was remarkably simple: a whitepaper, a GitHub repository, and a Telegram group could attract thousands of retail investors via an Initial Coin Offering (ICO). Founders operated anonymously with near-zero regulatory and financial barriers, enabling rapid, global innovation but also widespread fraud. By 2026, the landscape is fundamentally different. To operate in major markets like the US, EU, and Asia, crypto businesses must now navigate a complex web of regulations akin to traditional finance. Compliance costs are prohibitive: estimates for a US multi-state operation range from $750,000 to $1.2 million in the first three years, with annual costs exceeding $2 million thereafter. Regulations like MiCA in the EU and New York's BitLicense have created high capital and operational hurdles that act as barriers to entry. Simultaneously, venture capital investment has shifted dramatically. Following the collapses of Terra and FTX, funding has concentrated in later-stage, established companies, creating a "barbell market." Early-stage and seed funding has shrunk significantly, while mega-funds like Andreessen Horowitz's $15 billion pool dominate. Most capital now flows to trading platforms, lending infrastructure, and B2B services. This environment favors mergers and acquisitions as the primary path for growth. Companies like Coinbase and Ripple are acquiring firms like Deribit and Hidden Road not for their technology, but for their licenses, banking relationships, and institutional trust—assets far more valuable than code. Distribution channels, compliance, and brand reputation have become the new moats, overshadowing pure technical innovation. The industry's maturation brings benefits: reduced scams, increased institutional participation, and clearer regulatory frameworks. However, it comes at a cost. The low-barrier, experimental ethos that defined crypto's first decade is fading. Entrepreneurs without substantial capital, pre-existing licenses, or institutional connections face immense challenges. Funding for exploratory fields like decentralized social media or novel governance models is drying up. Ultimately, the crypto industry is replicating the consolidation pattern seen in banking and tech after the 2008 financial crisis. While this brings stability and legitimacy, it raises a critical question: in this new, resource-intensive reality, is there still room for the disruptive, from-scratch innovation that gave birth to the sector?

Foresight News21m ago

A Decade of Change: The Demise of Crypto Startups

Foresight News21m ago

Is Cardano’s price rally over? Here’s why ADA could target $0.30 next

Cardano (ADA) has started Q3 with a strong 30% rally, outperforming many altcoins. However, it faces a key resistance at $0.20, a level it has failed to break previously, leading to a recent 2% pullback. On-chain data shows a concerning 68% yearly drop in Total Value Locked (TVL), suggesting liquidity hasn't kept pace with the price rise. Despite this, the network has consistently added thousands of new wallets since mid-2023, indicating growing user adoption beneath the surface. If ADA can decisively break above the $0.20 resistance, turning it into support, the next targets could be $0.25 and potentially $0.30, especially within a historically bullish July for altcoins. The current cooldown may represent a healthy reset rather than a trend reversal.

ambcrypto35m ago

Is Cardano’s price rally over? Here’s why ADA could target $0.30 next

ambcrypto35m ago

First Batch of GPT-5.6 Sol Internal Test Results Are In, Same-Task Cost is Only Half That of Fable 5

"GPT-5.6 Sol", the preview version of OpenAI's latest model, has released its first batch of internal testing results. According to an Nvidia engineer, Sol achieved CUDA acceleration results in 30 hours that took Opus 64 hours. The model is positioned for high-difficulty reasoning and complex, long-chain tasks like coding. Initial user feedback highlights that Sol produces more concise code—approximately 1/5 the lines of Opus—with a style closer to human-written code, favoring deep optimization over brute-force trial and error. In tests, Sol demonstrated superior performance in instruction following, spatial reasoning, and front-end design consistency compared to GPT-5.5 Pro. When compared to the recently relaunched competitor Fable 5, Sol shows slightly lower overall performance and code quality in some areas. For instance, Fable 5 can generate a playable game from a single prompt faster. However, Sol's key advantage is cost: at $5 per million input tokens and $30 per million output tokens, it is roughly half the price of Fable 5 ($10/$50). Additionally, users report Fable 5's safety restrictions are overly stringent, frequently blocking tasks, whereas Sol's safeguards are reportedly more tailored and less limiting. The model is expected to roll out fully to all users in the coming days.

marsbit1h ago

First Batch of GPT-5.6 Sol Internal Test Results Are In, Same-Task Cost is Only Half That of Fable 5

marsbit1h ago

Robots Learn Operations by Watching Videos: Berkeley First to Bridge the Gap from Internet Videos to Real Dexterous Hand Deployment

UC Berkeley researchers introduce "Do as I Do," an end-to-end pipeline enabling robots to learn dexterous manipulation directly from everyday monocular RGB videos. The system overcomes key bottlenecks in scaling robot learning by first reconstructing 4D hand-object interactions from noisy web videos using a guided diffusion-based tracking method that outperforms existing approaches. It then robustly retargets these trajectories—which are often discontinuous or physically implausible—to a 22-DoF Sharpa Wave dexterous hand. The method incorporates a dynamics-aware optimizer with adaptive contact modeling and multi-stage refinement to handle trajectory noise, improving real-world retargeting success from 25% to 71%. Validated across 20 complex action categories (e.g., stirring, hammering, writing), the pipeline generated 500 executable trajectories and was successfully deployed at 50Hz on a dual-UR3e arm and dual-Sharpa Wave hand platform for 10 real-world tasks. The work establishes a crucial link, transforming the vast repository of human video data into actionable robot policies for anthropomorphic hands.

marsbit1h ago

Robots Learn Operations by Watching Videos: Berkeley First to Bridge the Gap from Internet Videos to Real Dexterous Hand Deployment

marsbit1h ago

Trading

Spot

Hot Articles

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of ETH (ETH) are presented below.

活动图片

Top Questions