Briefing
A recent incident highlights a significant “hacker-on-hacker” event where the perpetrator of the UXLINK protocol exploit subsequently lost approximately $48 million of stolen tokens to a sophisticated phishing attack. This secondary compromise underscores the pervasive nature of social engineering threats, even impacting experienced cybercriminals operating within the decentralized finance (DeFi) ecosystem. The initial UXLINK breach involved the exploitation of “delegateCall” functions within smart contracts, leading to unauthorized minting and asset drainage, while the subsequent phishing attack leveraged deceptive tactics to gain control over the exploiter’s ill-gotten gains. The incident resulted in a total loss of 542 million UXLINK tokens from the exploiter’s wallet.
Context
Prior to this incident, the digital asset landscape was characterized by a persistent attack surface stemming from both technical vulnerabilities in smart contracts and human susceptibility to social engineering. The UXLINK protocol itself had recently suffered a significant exploit, where attackers compromised its multi-signature wallet by manipulating delegateCall functions, enabling the theft and unauthorized minting of tokens. This pre-existing state of vulnerability, particularly concerning multi-signature wallet security and the broader threat of phishing, created fertile ground for subsequent exploitation, even among those who had successfully executed prior attacks.
Analysis
The incident unfolded in two distinct phases. Initially, UXLINK’s smart contracts on Ethereum and Arbitrum were compromised through the exploitation of delegateCall functions, allowing attackers to seize control of the project’s multi-signature wallet, revoke admin privileges, and mint billions of unauthorized UXLINK tokens. Subsequently, the wallet holding these stolen assets became the target of a phishing attack orchestrated by the “Inferno Drainer” group.
This secondary attack leveraged deceptive contracts, tricking the UXLINK exploiter into unknowingly granting approval for the malicious contract to transfer their stolen tokens, effectively draining approximately 542 million UXLINK tokens from their possession. This chain of events demonstrates how a lack of vigilance, even by sophisticated actors, can be exploited through common social engineering tactics.
Parameters
- Initial Protocol Targeted → UXLINK
- Initial Attack Vector → Smart Contract delegateCall Vulnerability, Multi-signature Wallet Compromise
- Secondary Attack Victim → UXLINK Exploiter’s Wallet
- Secondary Attack Vector → Phishing, Malicious Contract Approval (“increase Allowance trick”)
- Secondary Attacker Group → Inferno Drainer
- Total Funds Lost (from exploiter) → ~$48 Million (542 Million UXLINK tokens)
- Affected Blockchains (initial exploit) → Ethereum, Arbitrum
- Date of Phishing Incident → September 23, 2025
Outlook
This incident serves as a critical reminder that robust security practices are paramount for all participants in the digital asset space, regardless of their operational intent. Users and protocols must implement enhanced vigilance against phishing, including meticulous verification of contract interactions and approval requests. The “hacker-on-hacker” nature of this event underscores the chaotic and high-risk environment of unregulated digital asset movements, suggesting that even illicit gains are highly susceptible to further compromise. This will likely reinforce the need for advanced wallet security measures and continuous education on social engineering tactics across the entire Web3 ecosystem, potentially leading to new best practices in transaction simulation and pre-approval analysis.
