UXLINK Attacker Opens $68.3 Million ETH Long Position on Hyperliquid

Security analysts have identified significant on-chain activity involving an address linked to the recent UXLINK exploit. According to data provided by the blockchain security firm PeckShield, an address suspected to be associated with the attacker (0xDE8d9...d9524) has initiated a substantial leveraged position on the decentralized perpetual exchange Hyperliquid. The actor utilized funds previously moved through intermediary wallets to back a massive bet on the price of Ethereum.

Large-Scale Leveraged Position on Hyperliquid

The suspected attacker currently maintains a long position of approximately 21,550 ETH, which carries a market value of roughly 68.3 million USD. Technical details of the trade reveal a high-risk strategy, characterized by the following parameters:

• The position was opened at an average price of approximately 3,168.45 USD per ETH.
• The trader is utilizing 15x cross leverage, significantly amplifying both potential gains and liquidation risks.
• The collateral for this trade appears to stem from a prior transfer of 11 million USDC received from another linked address (0x35Eb7...5D43).

Tracking the Flow of Exploited Funds

The movement of these assets highlights the ongoing challenge of tracking capital across the Ethereum blockchain and Layer 2 ecosystems. Hyperliquid, a decentralized platform for perpetual futures, allows users to trade with high leverage without traditional KYC requirements, making it a frequent destination for actors seeking to obfuscate or grow illicitly obtained funds. The link between the UXLINK incident and this specific wallet address suggests that the perpetrator is attempting to maximize the utility of the stolen capital through aggressive market speculation.

The monitoring of the address 0xDE8d9...d9524 remains a priority for security researchers as they attempt to map the full extent of the UXLINK breach. While the long position reflects a bullish outlook on Ethereum (ETH), the high leverage indicates a volatile risk profile. The cryptocurrency community and security protocols continue to observe these movements to identify potential off-ramps or further transfers to centralized exchanges where assets might be frozen.