UXLINK Hacker Liquidates 30,000 ETH Long Position, Faces $3.1M Loss

An address associated with the UXLINK hacker has concluded a massive liquidation of its Ethereum (ETH) long positions, resulting in a multi-million dollar loss. According to monitoring data from on-chain analyst Ai Yi, the wallet liquidated approximately 30,000 ETH over an 11-hour period via a Time-Weighted Average Price (TWAP) strategy. Despite previously holding significant unrealized gains, the volatile market conditions forced a closure that wiped out over $3 million in capital.

Details of the Hyperliquid Liquidation

The trader, whose funds are linked to the September 2025 security breach of the Web3 social platform UXLINK, had maintained a leveraged long position on the decentralized perpetual exchange Hyperliquid for nearly three months. On-chain records indicate the following specifics of the exit:

• Total Position Size: Approximately 30,282 ETH.
• Execution Method: TWAP algorithm over 11 hours to minimize slippage.
• Average Exit Price: $2,135.2 per ETH.
• Final Realized Loss: $3.106 million.

The use of a TWAP strategy is typically employed by large-scale traders (whales) to execute sizable orders without causing immediate, drastic price fluctuations in the underlying asset's market depth.

Market Volatility and Vanishing Profits

At its peak performance, the hacker's position was significantly "in the money." Analysts noted that the address had previously seen unrealized profits of nearly $7.8 million when Ethereum prices were trading at higher levels. However, recent downward pressure on ETH, which saw the cryptocurrency struggle to maintain support levels, eroded these gains.

The address liquidated nearly three months of 30,000 ETH long positions via TWAP... ultimately resulting in a loss of $3.106 million.

The original UXLINK exploit, which occurred on September 22, 2025, involved a delegateCall vulnerability that allowed the attacker to drain over $40 million in assets. Since that event, the associated wallets have been closely monitored by the security community, revealing that the perpetrator had been actively trading on-chain with the stolen proceeds, including high-leverage bets on Solana (SOL) and XRP in addition to Ethereum.

The final liquidation of this ETH position marks a significant setback for the attacker's on-chain portfolio. While the wallet still holds other assets, the failure of this high-conviction long trade highlights the risks inherent in leveraged crypto derivatives, even for sophisticated actors. This event serves as a notable example of how market volatility can affect large-scale "hacker-turned-trader" addresses, leading to substantial capital depletion.