Review and Impact Analysis of the UXLINK Theft Incident

Deng Tong, Golden Finance

In the early morning of September 23, 2025, the security company Cyvers' systems detected $11.3 million in suspicious transactions involving UXLINK. UXLINK is suspected to have been stolen. This morning, SlowMist Yuxian published a post on the X platform confirming that UXLINK had been hacked.

Following the hack, UXLINK plummeted, trading at $0.08529 as of press time, a 71.9% drop in 24 hours. However, two weeks prior, on September 10, UXLINK CEO Rolland Saf announced that he would begin a six-year preparation to run for Cameroon's presidential election in 2032.

This article reviews the UXLINK theft incident and the official and various responses from UXLINK, analyzing the cause of the theft and the impact of the theft.

I. Reconstruction of the Theft Incident and Official and Various Responses from UXLINK

Security company Cyvers first released information about the suspected theft of UXLINK at 00:43: An Ethereum address executed a delegateCall, removed administrator privileges, and called "addOwnerWithThreshold," then transferred 4 million USDT, 500,000 USDC, 3.7 WBTC, and 25 ETH. All USDC/USDT on the Ethereum network was converted to DAI, while USDT on the Arbitrum network was converted to ETH and transferred across the Ethereum network. Minutes later, another address received 10 million UXLINK (approximately $3 million) and began converting them. About an hour later, UXLINK posted on X, confirming the theft:

Urgent Security Notice

We discovered a security vulnerability in our multi-signature wallet, which resulted in a large amount of cryptocurrency being illegally transferred to centralized exchanges (CEX) and decentralized exchanges (DEX).

Our team is working around the clock with internal and external security experts to identify the root cause and contain the situation.

We have contacted major centralized exchanges (CEX) and decentralized exchanges (DEX) to urgently freeze suspicious UXLINK deposits and are working closely with them to prevent further transfer of funds. We have reported this incident to the police and relevant authorities to expedite legal action and fund recovery. We remain committed to transparency and will continue to provide timely updates to the community. This morning, UXLINK officially released two security incident updates: The team has worked closely with major exchanges to successfully freeze the majority of the stolen assets. The team has commissioned @peckshield to assist in the investigation and strengthen asset recovery efforts. Officials stated that no direct attacks on individual user wallets have been discovered, and a clear account recovery and compensation plan will be developed as soon as possible. Following the theft of funds, the hacker issued an additional 1 billion UXLINK tokens on-chain. UXLINK confirms hacker issuance of additional UXLINK: "We have detected ongoing unauthorized minting of UXLINK tokens by malicious actors. To protect the community and ecosystem, we are taking urgent measures: We are urgently contacting major centralized exchanges (CEXs) to temporarily suspend UXLINK trading. We will immediately initiate a token swap program to ensure the integrity of the token economy. Details and operational guidelines for the token swap will be released soon. We strongly advise all community members to remain vigilant and only obtain the latest information through official channels." According to Lookonchain monitoring, the UXLINK hacker sold UXLINK on-chain through six addresses, obtaining 6,732 ETH worth $28.1 million. In addition, the hacker also sold a large amount of UXLINK on various CEXs. However, the hacker appears to have been victimized. According to Scam Sniffer monitoring, the exploited UXLINK address appears to have signed a malicious increaseAllowance authorization for a phishing contract, resulting in the transfer of approximately 542 million UXLINK tokens to the phishing address. Due to suspected security issues, South Korean exchanges Upbit and Bithumb have designated UXLINK as a "trading alert." Upbit has also suspended deposits and withdrawals for UXLINK, with a resumption date to be announced later. Both exchanges stated they will conduct technical and compliance assessments based on trading alert procedures before deciding whether to adjust trading support and related services.

2. Cause of the Theft

SlowMist Yuxian posted on the X platform, "After reviewing the UXLINK theft, it's highly likely that several private keys related to UXLINK's Safe multi-sig were leaked. The hacker performed several key operations, changing the owner of the targeted Safe multi-sig to: 0x2EF43c1D0c88C071d242B6c2D0430e1751607B87 Then, 0x2EF43c completed the subsequent fund transfer. We at @SlowMist_Team, @MistTrack_io, and @im23pds are assisting the project team with their follow-up investigation."

3. What is UXLINK?

UXLINK, incorporated in Singapore in 2023, is a groundbreaking web3 social system designed for mass adoption, allowing users to build social assets and trade cryptocurrencies. It comprises a series of highly modular Dapps, from onboarding to graph formation, group tools, and social trading, all seamlessly integrated into Telegram.

• March 2023: UXLINK Dapp officially launched on the Telegram platform.

• March 2024: Received $9 million in funding led by OKX Ventures.

• May 2024: Received $5 million in funding led by SevenX, HashKey Capital, and INCE Capital. Simultaneously, the number of registered users exceeded 10 million, making it the world's largest Web3 social platform and infrastructure.

• July 2024: UXLINK was listed on several major trading platforms.

• June 2025: UXLINK performed exceptionally well on Upbit, with a peak increase of 17%, making it the platform's top gainer.

IV. Impact of the UXLINK Theft

1. UXLINK's Economic Losses

As mentioned at the beginning of this article, the UXLINK theft directly caused the UXLINK token price to plummet by over 70%. Furthermore, the hacker is continuously selling UXLINK on-chain and on major CEX exchanges, which will undoubtedly further increase the selling pressure in the market.

Especially serious is the fact that the hacker issued an additional 1 billion UXLINK on-chain, which directly impacts the token's economic model—the original total supply was only 1 billion, and this additional issuance doubled the circulating supply, completely diluting the equity of existing holders. 2. User Trust in UXLINK Decreased Following this hack, user trust in UXLINK has significantly declined. Even with the endorsement of previous investors like OKX Ventures, SevenX, and HashKey Capital, users have begun to question UXLINK. UXLINK's "X" account is flooded with questions about compensation plans and asset recovery, all of which UXLINK needs to address head-on. 3. Reflections on the Security of Multi-Signature Wallets Multi-sig wallets rely on multiple keys to authorize transactions, rather than a single user. This mechanism improves security and prevents unauthorized access to funds. However, UXLINK's core issue is the leakage of multi-sig private keys, demonstrating that even with multi-sig, security issues, such as private key leaks, can still exist. For cryptocurrency projects, stricter private key management and enhanced fund security are fundamental to their long-term success.

Conclusion

While UXLINK boasts the reputation of being the "world's largest Web3 social platform," its years-built reputation is ultimately no match for a single hacker attack. Whether UXLINK can turn the tide and regain lost users and market confidence will depend on the platform's subsequent asset recovery efforts and user compensation plans.