A wallet suspected of belonging to the UXLINK hacker is holding a long position of 30,282 ETH, with as much as $6.54 million in unrealized gains.
The position was identified by on-chain analyst Yu Jin, who also goes by Ember. It sits on Hyperliquid, a decentralized exchange built for perpetual futures trading.
Inside the suspected hacker’s ETH bet
The long position is reported at between 30,282 and 30,300 ETH. It was built at an average entry price of $2,134.
That gives the position a notional value of roughly $70.25 million. Estimates of the unrealized gains vary, ranging from $5.62 million to $6.54 million as of October 27, 2026.
The trading record is not a one-off. The suspected hacker has reportedly made six earlier Ethereum trades on Hyperliquid, realizing $5.71 million in profits from them.
How the wallet was tied to the exploit
Yu Jin linked the trading wallet to the exploit by tracing overlapping fund movements.
The biggest clue was a consolidation of 11.54 million USDC into the wallet that funded the ETH long. The analyst also pointed to shared gas-fee activity connected to known hacker addresses.
The wallet has shown consistent trading activity since August 2026, according to the research findings. The link remains a suspicion based on on-chain analysis. No owner has been publicly confirmed.
A look back at the UXLINK exploit
The UXLINK exploit took place on September 22, 2025. The attacker took advantage of a delegateCall vulnerability to seize unauthorized control of the project’s multisig wallet.
Total losses were estimated at approximately $40 million, though some reports put the figure as high as $48 million.
The attacker minted trillions of unauthorized UXLINK tokens, flooding the supply. The token’s price fell sharply in response, with estimates of the drop ranging from around 70% to 99% immediately after the exploit.
The breach also brought project operations to a halt. Since then, the attacker has continued to move and trade the stolen assets, including ETH, across multiple chains, and reportedly took further losses along the way.
What this means for exchanges, projects, and traders
A wallet tied to a $40 million breach has reportedly run a profitable ETH strategy on a major perpetuals venue for months.
For DeFi projects, the UXLINK case is a reminder that a multisig is only as strong as the contract logic around it. A single delegateCall flaw turned a security feature into a single point of failure, and the downstream effects included minted supply, a crashed token, and halted operations.
A position of roughly $70.25 million is large enough to be noticed. When it is tied to a suspected hacker, the market tends to watch for exits, since closing a long of that size means selling ETH back into the order book.
Disclosure: This article was edited by John Chen. For more information on how we create and review content, see our Editorial Policy.