Briefing
On September 22, 2025, the UXLINK multi-signature wallet suffered a critical exploit, resulting in an estimated $11.3 million loss of digital assets. Attackers leveraged a delegate call vulnerability to seize administrative control, enabling unauthorized fund transfers and the minting of 10 trillion UXLINK tokens, which caused a 70% price collapse and eroded $2.1 billion in market value. This incident highlights the profound systemic risk associated with misconfigured smart contract functions in multi-signature architectures.
Context
Prior to this incident, multi-signature wallets were generally considered a robust security measure, requiring multiple approvals for transactions. However, the prevailing attack surface included the inherent complexity of delegate call functions and the potential for misconfiguration, which could undermine the intended security guarantees. This class of vulnerability often arises when contract logic grants excessive privileges or fails to properly validate external calls, creating an exploitable pathway for adversaries.
Analysis
The incident’s technical mechanics centered on a delegate call vulnerability within UXLINK’s multi-signature wallet, specifically targeting the addOwnerWithThreshold function. The attacker exploited this flaw to remove legitimate admin privileges and replace them with their own address, effectively gaining full control over the wallet. This administrative access then facilitated unauthorized transfers, draining approximately $4 million in USDT, $500,000 in USDC, 3.7 WBTC, and 25 ETH. Concurrently, the attacker minted 10 trillion counterfeit UXLINK tokens on the Arbitrum blockchain, which were then partially liquidated, destabilizing the market and causing a severe price crash.
Parameters
- Protocol Targeted → UXLINK
- Attack Vector → Delegate Call Vulnerability (Multi-signature Wallet)
- Financial Impact → $11.3 Million (total estimated loss)
- Affected Assets → USDT, USDC, WBTC, ETH, UXLINK tokens
- Affected Blockchain → Arbitrum
- Token Price Impact → 70% collapse, $2.1 Billion market value eroded
- Exploit Date → September 22-23, 2025
Outlook
Immediate mitigation for affected users involved UXLINK’s implementation of a token swap to restore supply integrity, while broader implications necessitate a re-evaluation of multi-signature wallet security. This incident will likely establish new security best practices, emphasizing mandatory smart contract audits, enhanced wallet security measures, and robust collaboration frameworks with exchanges to freeze illicit assets. Protocols must prioritize a “security-first” mindset, investing in continuous audits and bug bounty programs to preempt similar delegate call vulnerabilities.
