Multi-Signature Wallet Compromised via DelegateCall, Draining Millions → Security

A futuristic transparent device, resembling an advanced hardware wallet or cryptographic module, displays intricate internal components illuminated with a vibrant blue glow. The top surface features tactile buttons, including one marked with an '8', and a central glowing square, suggesting sophisticated user interaction for secure operations

A close-up view highlights a futuristic in-ear monitor, featuring a translucent deep blue inner casing with intricate internal components and clear outer shell. Polished silver metallic connectors are visible, contrasting against the blue and transparent materials, set against a soft grey background

Briefing

A recent exploit targeted a multi-signature wallet, leveraging a delegateCall vulnerability to grant an attacker full administrative control. This critical flaw allowed the malicious actor to remove legitimate admin privileges, replace them with their own, and subsequently drain approximately $4.5 million in stablecoins, Wrapped Bitcoin, and Ethereum. The attacker further destabilized the market by minting 10 trillion unauthorized tokens, causing the protocol’s token price to plummet by 70% and eroding $2.1 billion in market value. This incident highlights the profound financial consequences arising from technical misconfigurations in ostensibly secure systems.

An abstract composition features numerous faceted blue crystals and dark blue geometric shapes, interspersed with white spheres and thin metallic wires, all centered within a dynamic structure. A thick, smooth white ring partially encompasses this intricate arrangement, set against a clean blue-grey background

Context

Prior to this incident, multi-signature wallets were widely considered a robust security measure, requiring multiple approvals for transactions and intended to mitigate single points of failure. However, the prevailing attack surface in decentralized finance (DeFi) continues to include complex smart contract interactions, where subtle logic flaws can be exploited. This exploit leveraged a known class of vulnerability related to improper handling of delegateCall functions, demonstrating that even established security primitives can be undermined by implementation errors.

A sophisticated, silver-grey hardware device with dark trim is presented from an elevated perspective, showcasing its transparent top panel. Within this panel, two prominent, icy blue, crystalline formations are visible, appearing to encase internal components

Analysis

The incident’s technical mechanics centered on a delegateCall vulnerability within the multi-signature wallet’s smart contract. The attacker exploited this flaw to execute a malicious function, specifically addOwnerWithThreshold , which allowed them to bypass existing access controls. By replacing the legitimate admin addresses with their own, the attacker gained unauthorized administrative privileges.

This compromise enabled the direct draining of funds from the wallet and facilitated the unauthorized minting of a vast quantity of new tokens, leading to severe market dilution and a significant drop in the token’s value. The chain of cause and effect demonstrates how a single misconfigured function can unravel an entire protocol’s security posture.

The image displays a close-up perspective of two interconnected, robust electronic components against a neutral grey background. A prominent translucent blue module, possibly a polymer, houses a brushed metallic block, while an adjacent silver-toned metallic casing features a circular recess and various indentations

Parameters

Protocol Targeted → UXLINK
Attack Vector → DelegateCall Vulnerability in Multi-signature Wallet
Financial Impact → $4.5 Million Drained Directly; $2.1 Billion Market Value Erosion
Assets Drained → USDT, USDC, WBTC, ETH
Unauthorized Activity → 10 Trillion Tokens Minted
Token Price Impact → 70% Collapse
Date of Incident → September 2025

An abstract, dark, multi-layered object with intricate, organic-like cutouts is depicted, covered and surrounded by a multitude of small, glowing blue and white particles. These particles appear to flow dynamically across its surface and through its internal structures, creating a sense of movement and digital interaction

Outlook

Immediate mitigation for users involves reassessing exposure to protocols utilizing complex multi-signature wallet implementations, particularly those with opaque delegateCall logic. This incident will likely establish new security best practices emphasizing rigorous, continuous auditing of all contract functions, especially those granting administrative control. Protocols must prioritize real-time monitoring of on-chain activity and robust contingency plans for rapid response, including token swaps and freezing suspicious deposits. The contagion risk extends to similar DeFi protocols that may share analogous architectural vulnerabilities, necessitating a systemic review across the ecosystem.

The UXLINK multi-signature wallet exploit serves as a stark reminder that even foundational security mechanisms can introduce systemic risk when implementation flaws allow for administrative privilege escalation and unbounded token supply manipulation.

Signal Acquired from → ainvest.com