Briefing
A recent security incident saw an attacker who initially compromised the UXLINK AI-powered Web3 social platform’s multi-signature wallet fall victim to a sophisticated phishing scam. This “hacker-on-hacker” event resulted in the original exploiter losing approximately $48 million in stolen UXLINK tokens to a secondary threat actor. The incident highlights the pervasive and unpredictable nature of social engineering attacks within the decentralized finance ecosystem, demonstrating that even sophisticated cybercriminals are susceptible to basic security pitfalls.
Context
Prior to this incident, the broader DeFi landscape has consistently faced vulnerabilities stemming from both technical flaws and human factors. While smart contract audits aim to mitigate code-level risks, the attack surface often extends to administrative controls, private key management, and user interaction points. This environment fosters an ongoing threat where even illicitly gained assets remain vulnerable to further exploitation through common cyber threats like phishing, underscoring a systemic lack of robust safeguards in decentralized finance.
Analysis
The initial UXLINK compromise involved the attacker leveraging a vulnerability within the platform’s multi-signature wallet, executing a delegateCall to alter administrative roles and gain unauthorized control. This allowed the malicious actor to mint and subsequently offload UXLINK tokens, netting approximately $28.1 million in ETH. However, the exploiter’s subsequent downfall was a result of a phishing attack, where they unknowingly signed a malicious increaseAllowance contract. This action granted another threat group, reportedly linked to the Inferno Drainer network, the permissions necessary to transfer the $48 million in stolen UXLINK tokens from the original exploiter’s wallet to their own addresses.
Parameters
- Initial Victim → UXLINK Platform
- Secondary Victim → UXLINK Exploiter
- Initial Attack Vector → Multi-signature Wallet Compromise
- Secondary Attack Vector → Phishing (Malicious increaseAllowance Signature)
- Total Funds Lost by Exploiter → $48 Million UXLINK Tokens
- Blockchain(s) Involved → Ethereum, Arbitrum
- Date of Secondary Exploit → September 23, 2025
- Threat Group (Secondary) → Allegedly Inferno Drainer Network
Outlook
This incident serves as a critical reminder that the security posture of digital assets extends beyond protocol-level vulnerabilities to encompass the operational security of all participants, including threat actors themselves. Users and protocols must implement stringent multi-factor authentication, exercise extreme caution with wallet signatures, and regularly audit all contract interactions. The “hacker-on-hacker” dynamic may lead to increased vigilance among criminal elements, but for legitimate users, it reinforces the necessity of adopting comprehensive security practices and recognizing phishing as a persistent, high-impact threat that targets human judgment.
Verdict
The UXLINK “hacker-on-hacker” event decisively demonstrates that even illicitly acquired digital assets remain critically exposed to social engineering, highlighting an enduring vulnerability across the entire decentralized ecosystem.
