Decentralized social platform UXLink has rolled out a new Ethereum contract after a multisignature wallet exploit allowed attackers to mint billions of unauthorized tokens and crash the price of its native asset.
The project said Wednesday that the new smart contract, which has passed a security audit, will be deployed on the Ethereum mainnet. Unlike its predecessor, it removes the mint-burn function to prevent similar exploits.
UXLink confirmed the breach on Tuesday, noting that a large amount of crypto had been funneled to exchanges. Loss estimates vary: blockchain security firm Cyvers Alerts put the figure at over $11 million, while Hacken suggested it may exceed $30 million.
While the exact damage remains uncertain, the incident underscores vulnerabilities in smart contract design. Marwan Hachem, co-founder and CEO of Web3 security firm FearsOff, told that the case illustrates the risks of moving too quickly without implementing robust security layers.
Attackers compromised UXLink’s smart contract through a multisignature wallet breach, initially minting 2 billion UXLINK tokens. The token’s price plunged 90% from $0.33 to $0.033 as the attacker continued creating tokens, with security firm Hacken estimating nearly 10 trillion were ultimately minted.
According to Marwan Hachem, co-founder and CEO of Web3 security firm FearsOff, the exploit stemmed from a delegate call vulnerability in the multisignature wallet. This flaw allowed the attacker to execute arbitrary code, seize administrative control of the contract, and mint unauthorized tokens.
“This really spotlights some design flaws in UXLink’s setup,” Hachem told Cointelegraph. “A multisignature wallet that wasn’t shielded against delegate call exploits, weak controls over minting, and no code enforcing a supply cap.” He added that concentrating too much authority in one place undermines claims of decentralization.
Safeguards that could have prevented the breach
From a technical standpoint, Hachem said the hack could have been avoided with basic safeguards. These include timelocks on sensitive functions such as minting or changing contract ownership. “A 24- to 48-hour delay gives the community time to spot irregularities before they take effect,” he explained.
He also recommended renouncing minting privileges once tokens are launched and hardcoding supply caps into smart contracts to prevent unauthorized token creation.
Operationally, Hachem emphasized stronger oversight: independent reviews, continuous transparency, and auditing not just token contracts but multisignature setups as well. He urged projects to make wallet addresses public and require multiple signers for all transactions.
“The broader lesson,” Hachem said, “is that widely used tools like multisig wallets aren’t bulletproof. Projects need decentralized governance, emergency stop mechanisms, and layered defenses from the start. Otherwise, rushing ahead without robust security can shatter community trust.”
