UXLink Exploiter Moves $15M: Converts WBTC and Uses Tornado Cash

The perpetrators behind the UXLink security breach have initiated a series of large-scale asset transfers to obfuscate the trail of stolen funds. According to on-chain data monitored by PeckShield, the attackers have successfully converted 92 Wrapped Bitcoin (WBTC), valued at approximately $8.4 million, into 3,248 Ethereum (ETH). Following this conversion, a significant portion of the assets was funneled through the privacy-enhancing protocol Tornado Cash to sever the link between the exploit and the destination wallets.

Details of the Multi-Signature Wallet Breach

The initial attack on UXLINK, a prominent decentralized social platform, occurred on September 22, 2025. Security analysts determined that the incident was the result of a multi-signature wallet compromise, which allowed the attackers to drain assets totaling over $15 million. This breach highlighted vulnerabilities in the protocol’s private key management and governance structure, leading to immediate scrutiny of the project's security protocols. Multi-signature setups are typically designed to provide enhanced security, but they remain susceptible if a sufficient number of keys are compromised or leaked simultaneously.

Asset Laundering via Decentralized Protocols

Since the exploit, the attackers have utilized various decentralized finance (DeFi) tools to manage the stolen capital. The recent movement of funds involves:

• Converted 92 WBTC into 3,248 ETH via decentralized exchanges.
• Deposited 1,500 ETH into the Tornado Cash mixer to enhance anonymity.
• Distributed remaining ETH across multiple temporary addresses to complicate tracking efforts by law enforcement and blockchain forensics firms.

Ongoing Investigation and Security Implications

The use of Tornado Cash, a protocol currently under regulatory pressure in several jurisdictions, remains a primary method for hackers to exit the Ethereum blockchain without detection. Security firms continue to monitor the remaining funds, which constitute a significant portion of the UXLINK losses. While the project team has not yet recovered the assets, the incident serves as a reminder of the persistent risks associated with centralized points of failure within decentralized systems.

The UXLINK incident is part of a broader trend of high-value exploits targeting social-fi and infrastructure projects. As the investigation continues, the industry awaits further updates on whether any of the laundered funds can be frozen at the exchange level or if the attackers will successfully complete their exit strategy.