损失超千万美元,UXLINK安全事件漏洞分析与被盗资金追踪

marsbitОпубліковано о 2025-09-23Востаннє оновлено о 2025-09-24

9月23日,UXLINK因多签钱包私钥泄露受到攻击,攻击者通过铸造UXLINK代币,抛售获利超过1130万美元。Beosin安全团队对本次攻击事件进行了漏洞分析和资金追踪,并将结果分享如下:

事件回顾

UXLINK项目合约因私钥泄露,导致攻击者地址被添加为其合约的多签账户并移除原先的其它多签账户,且合约的签名阈值被重置为1,只需攻击者地址进行签名即可执行合约操作,攻击者实现了对合约的完全控制。随后,攻击者开始增发UXLINK代币并卖出进行获利。

UXLINK

攻击者增发了5次代币,三个收取代币地址0xeff9cefdedb2a34b9e9e371bda0bf8db8b7eb9a7、0x2ef43c1d0c88c071d242b6c2d0430e1751607b87、0x78786a967ee948aea1ccd3150f973cf07d9864f3通过兑币、中转和跨链将UXLINK代币兑换为ETH和DAI储存在ETH链地址上。

被盗资金追踪

以下是Beosin安全团队对本次安全事件中的主要资金流向进行的分析:

ARBITRUM链

黑客地址:0x6385eb73fae34bf90ed4c3d4c8afbc957ff4121c

被盗地址:0xCe82784d2E6C838c9b390A14a79B70d644F615EB

盗取金额约:904,401 USDT

盗取资金后黑客将904,401 USDT兑换成215.71 ETH通过跨链将ETH转移至以太坊地址0x6385eb73fae34bf90ed4c3d4c8afbc957ff4121c上。

UXLINK

Ethereum链

黑客地址:0x6385eb73fae34bf90ed4c3d4c8afbc957ff4121c

被盗地址:0x4457d81a97ab6074468da95f4c0c452924267da5、0x8676d208484899f5448ad6e8b19792d21e5dc14f、0x561f7ced7e85c597ad712db4d73e796a4f767654

盗取资金约:25.27ETH、5,564,402.99 USDT、3.7 WBTC、50万USDC

盗取资金后黑客将5,564,402.99 USDT和50万USDC兑换成6,068,370.29 DAI,最后将资金归集到地址0xac77b44a5f3acc54e3844a609fffd64f182ef931,该地址目前余额:240.99 ETH、6,068,370.29 DAI、3.7 WBTC。

UXLINK

Ethereum与Arbitrum的主要资金流向如下图所示:

UXLINK

据Beosin Trace分析,所有被盗资金仍存放在攻击者的多个地址中

Beosin Trace已将攻击者相关的所有地址加入黑名单,并持续追踪。以下是目前攻击者相关地址的余额情况:

UXLINK

Пов'язані матеріали

Wall Street Morning Report: S&P Earnings Growth Hits 30-Year High, Nvidia Becomes SpaceX's 6th Largest Shareholder

Wall Street Morning Report: S&P 500 earnings growth hits a 30-year high; Nvidia becomes SpaceX's 6th largest shareholder. Market Summary: U.S. stocks ended slightly lower on Friday after record highs, with the S&P 500 posting a weekly gain. Weaker-than-expected July retail sales data significantly reduced market expectations for a September Fed rate hike. Key Themes: * **Macro & Rates:** The probability of the Fed holding rates steady in September rose to ~70%. Geopolitical tensions in the Middle East supported oil prices near $90. Focus this week is on a $16B 20-year Treasury auction testing investor demand amid high yields. * **Corporate Earnings:** S&P 500 Q2 earnings grew 31%, the fastest pace since 1992 excluding recession recoveries, driving a valuation reset. * **AI & Tech Sector Rotation:** The AI investment narrative faces scrutiny over financing and return timelines. Semiconductor stocks saw divergence: memory (SanDisk, Micron) and optical communication (Applied Optoelectronics) surged, while Broadcom fell sharply on credit rating downgrade concerns over AI leasing exposure. * **Notable Moves:** Nvidia disclosed a ~$21B stake in SpaceX. AMD rose 6.5% after a record debt issuance. Reddit rallied ahead of its S&P 500 inclusion. This Week's Highlights: * **Fed Minutes (Thu):** Key for gauging policy divergence and September rate outlook. * **Key Earnings:** Alibaba, Walmart, Nvidia, AMD. * **Events:** Seoul AI Summit, World Robot Conference, potential恒生指数 rebalancing. * **Data:** U.S. jobless claims, Japan core CPI, Korea early export data (a leading indicator for semiconductors).

marsbit51 хв тому

Wall Street Morning Report: S&P Earnings Growth Hits 30-Year High, Nvidia Becomes SpaceX's 6th Largest Shareholder

marsbit51 хв тому

BTC in Range-Bound Consolidation, HYPE Daily Rebound Confirmed | Invited Analysis

**Market Analysis: BTC Consolidates in Range, HYPE Shows Daily Rebound Confirmation (Weekly Outlook)** **BTC Analysis:** The market is at a key juncture. Bitcoin is undergoing a daily correction, with a critical focus on whether it can find support and stabilize above the $60,950 level. The adjustment that began from the May 6th high has formed a complex seven-segment structure on the daily chart. Three potential paths are identified: 1. **Continuation of the c-wave rally** (primary scenario), targeting $67,300 initially, then $69,500-$71,000. 2. **Range-bound consolidation** between $60,950 and $65,500, forming an "ascending中枢" before an upward breakout. 3. **Breakdown and secondary探底** if support at $60,950-$61,500 fails. Analysis favors the first two scenarios. The 4-hour chart suggests the current adjustment phase is nearing completion near the strong $60,950-$61,500 support zone. **BTC Strategy:** * **Key Levels:** Support at $62,268, $60,950-$61,500, $57,820. Resistance at $65,500, $67,300, $69,500-$71,000. * **Mid-term:** Current model indicates a bearish structure with ~20% short exposure. Consider adding to shorts (up to 50%) only if price rallies to $69,500-$71,000, shows clear stagnation, and model confirms. * **Short-term (30% capital):** Two tactical plans: * **A) Test shorts** near strong resistance ($69,500-$71,000) upon signs of weakness. * **B) Test longs** near strong support ($60,950-$61,500) upon stabilization signals. **HYPE Analysis:** HYPE has established a daily rebound from the August 2nd low. The 4-hour chart shows a five-segment上升 structure with a formed "ascending中枢". The current (76-77) segment is crucial. Two outcomes are possible: 1. **Breakout (Central离开段):** If price breaks and holds above the $58-$58.5 resistance zone, the uptrend continues. Monitor for momentum背驰 between the initial and breakout segments. 2. **Consolidation (Central Extension):** Failure to hold above $58-$58.5 leads to a return to中枢 consolidation, requiring new signals for direction. **HYPE Strategy:** * **Key Levels:** Support at $50-$52, $45. Resistance at $58.5-$60, descending channel upper rail, $72.97. * **Watch:** Whether price can break/hold above $58-$58.5 to confirm the breakout. * **Action:** * **Existing longs (from $50-$52):** Move stop-loss above entry cost. * **New entrants:** Consider light longs only on a confirmed breakout above $58.5-$60 with a tight stop-loss. Exit quickly if momentum背驰 appears. **General Risk Management:** * Set initial stop-loss immediately upon entry. * Move stop-loss to breakeven at +1% profit. * Trail stop-loss upwards by 1% for every subsequent 1% gain to lock in profits. **Disclaimer:** Market conditions change rapidly. This analysis is for informational purposes only and not investment advice. Trading carries significant risk.

marsbit54 хв тому

BTC in Range-Bound Consolidation, HYPE Daily Rebound Confirmed | Invited Analysis

marsbit54 хв тому

Not Chasing AI or Buying Back Shares, Can 'Stingy' Jingdong Still Succeed?

On August 13th, JD.com (JD.US) released its Q2 2026 earnings, delivering a mixed and generally "flat" performance that met low expectations but offered few positives. Overall revenue declined by approximately 3% year-over-year (YoY) to ~¥346.4 billion, aligning with weakened domestic consumption trends. While group operating profit saw a YoY improvement, this was primarily due to reduced losses in the food delivery segment compared to the high-cost "delivery war" period of the previous year. Key details reveal deeper concerns: revenue from JD's core domestic retail segment fell 4.7% YoY. While electronics sales declined less than feared (~12% YoY), growth in daily necessities and advertising services plummeted by about 10 percentage points each, raising doubts about the segment's mid-term growth momentum post-subsidy adjustments. Logistics revenue growth also slowed to 5.9% as the delivery boom faded. Profitability presented a nuanced picture. The retail segment's operating margin edged up slightly YoY but failed to deliver the significant beats seen in past quarters, suggesting efficiency gains may be nearing limits. Losses from the New Businesses segment (including food delivery and overseas ventures) remained elevated at ~¥9.9 billion, as increased overseas investment partially offset reductions in delivery subsidies. Notably, JD's shareholder returns weakened significantly, with share buybacks in H1 2026 annualizing to only about 5% of market cap. The company opted to park cash in short-term investments rather than boost returns, drawing criticism. Looking ahead, JD's performance hinges on a potential recovery in China's e-commerce sentiment in H2 2026 and the scale of ongoing losses in new ventures. While not burdened by massive AI capex like some peers, and offering relative defensive stability, the lack of positive earnings surprises and diminished shareholder returns provide little compelling reason for investors to favor the stock in the near term.

marsbit1 год тому

Not Chasing AI or Buying Back Shares, Can 'Stingy' Jingdong Still Succeed?

marsbit1 год тому

Торгівля

Спот
活动图片