UXLINK will launch a token swap after a hacker exploited its multi-sig wallet and began minting tokens while also draining millions in assets.
UXLINK is preparing a token swap to protect its ecosystem after a hacker exploited its multi-signature wallet and continued unauthorized minting of tokens.
On Sept. 23, UXLINK posted a security update on X confirming that a malicious actor is still minting UXLINK tokens without authorization. The team said it is working with major centralized exchanges to suspend trading and will soon initiate a token swap plan to restore the project’s token economy.
The attack was first disclosed on Sept. 22 after blockchain security firm Cyvers flagged suspicious activity on UXLINK’s smart contracts. The project’s multi-sig wallet was compromised by hackers who exploited a “delegateCall” vulnerability to gain administrator privileges.
This made it possible for assets worth approximately $11.3 million to be stolen, including $4.5 million in stablecoins and major tokens such as ETH and WBTC.
The attacker also minted between 1-2 billion UXLINK tokens on Arbitrum (ARB), of which 490 million were initially received and later sold across decentralized exchanges. Proceeds were bridged to Ethereum (ETH) and swapped into ETH, netting around 6,732 ETH ($28.1 million at current prices).
Despite quick intervention from exchanges, including Upbit, which froze deposits, the minting exploit has left the token supply compromised. UXLINK’s price dropped over 70% in the aftermath, falling from $0.30 to near $0.09, erasing around $70 million in market cap.
The project emphasized that user wallets were not directly affected. Most of the hacker’s funds have been frozen on exchanges, and law enforcement agencies are involved in recovery efforts. PeckShield has been engaged to assist with the investigation and auditing.
With the ongoing unauthorized minting, UXLINK said a token swap will be rolled out “promptly” to protect holders and realign the supply with its whitepaper rules. Further instructions will be issued through official channels.
The team reiterated its focus on protecting its 55 million users and ensuring transparency during the recovery process.
