A wallet suspected of belonging to the UXLINK hacker is holding a long position of 30,282 ETH on the decentralized exchange Hyperliquid, with unrealized gains estimated at up to $6.54 million, according to on-chain analyst Yu Jin, who also goes by Ember.
Details of the ETH Position
The long position is reported at between 30,282 and 30,300 ETH, built at an average entry price of $2,134. That gives the position a notional value of roughly $70.25 million. Estimates of the unrealized gains vary, ranging from $5.62 million to $6.54 million as of October 27, 2026.
The trading record is not a one-off. The suspected hacker has reportedly made six earlier Ethereum trades on Hyperliquid, realizing $5.71 million in profits from them.
How the Wallet Was Tied to the Exploit
Yu Jin linked the trading wallet to the exploit by tracing overlapping fund movements. The biggest clue was a consolidation of 11.54 million USDC into the wallet that funded the ETH long. The analyst also pointed to shared gas-fee activity connected to known hacker addresses.
The wallet has shown consistent trading activity since August 2026, according to the research findings. The link remains a suspicion based on on-chain analysis. No owner has been publicly confirmed.
Background on the UXLINK Exploit
The UXLINK exploit took place on September 22, 2025. The attacker took advantage of a delegateCall vulnerability to seize unauthorized control of the project’s multisig wallet. Total losses were estimated at approximately $40 million, though some reports put the figure as high as $48 million.
The attacker minted trillions of unauthorized UXLINK tokens, flooding the supply. The token’s price fell sharply in response, with estimates of the drop ranging from around 70% to 99% immediately after the exploit. The breach also brought project operations to a halt. Since then, the attacker has continued to move and trade the stolen assets, including ETH, across multiple chains, and reportedly took further losses along the way.
Implications for Market Participants
A wallet tied to a $40 million breach has reportedly run a profitable ETH strategy on a major perpetuals venue for months. For DeFi projects, the UXLINK case is a reminder that a multisig is only as strong as the contract logic around it. A single delegateCall flaw turned a security feature into a single point of failure, and the downstream effects included minted supply, a crashed token, and halted operations.
A position of roughly $70.25 million is large enough to be noticed. When it is tied to a suspected hacker, the market tends to watch for exits, since closing a long of that size means selling ETH back into the order book.
