Briefing
A severe security incident has impacted UXLINK, an AI-powered web3 social platform, through a critical vulnerability within its multi-signature wallet system. This exploit granted an unauthorized actor administrative control, facilitating the illicit transfer of approximately $11.3 million in various crypto assets and the subsequent minting of trillions of UXLINK tokens. The incident underscores the profound risks associated with complex smart contract interactions, leading to a precipitous 70% decline in the UXLINK token’s market value and eroding an estimated $2.1 billion in market capitalization.
Context
Prior to this incident, multi-signature wallets were largely perceived as a robust security measure, requiring multiple approvals for transactions. However, the prevailing attack surface for such systems often includes misconfigurations or vulnerabilities in underlying smart contract logic, particularly concerning administrative functions. This class of vulnerability, while known, frequently becomes exploitable when delegateCall mechanisms are not rigorously secured, presenting an inherent risk to decentralized protocols that rely on shared control.
Analysis
The incident commenced on September 22, 2025, when an attacker exploited a delegateCall vulnerability within UXLINK’s multi-signature wallet. This specific weakness enabled the malicious actor to replace the legitimate admin role with their own address, effectively seizing full administrative control over the wallet. Subsequently, the attacker leveraged the addOwnerWithThreshold function to add a new, unauthorized multisig owner, facilitating the direct transfer of $4 million USDT, $500,000 USDC, 3.7 WBTC, and 25 ETH. Beyond direct asset draining, the compromised administrative access also permitted the attacker to mint approximately 10 trillion UXLINK tokens, which were then liquidated on decentralized exchanges for an additional $28.1 million in ETH, further destabilizing the protocol’s tokenomics.
Parameters
- Protocol Targeted → UXLINK
- Attack Vector → DelegateCall Vulnerability in Multi-Signature Wallet
- Total Financial Impact (Drained Assets & Liquidated Minted Tokens) → ~$39.4 Million
- Initial Assets Drained → $11.3 Million (USDT, USDC, WBTC, ETH)
- Minted Tokens Liquidated → ~$28.1 Million (from 10 Trillion UXLINK tokens)
- Blockchains Affected → Ethereum, Arbitrum
- Key On-chain Actions → Admin role replacement via delegateCall , new multisig owner addition via addOwnerWithThreshold , unauthorized token minting, asset swaps to DAI.
- Market Impact → UXLINK token price plummeted over 70%, $2.1 Billion market value erosion.
Outlook
Immediate mitigation for users involves exercising extreme caution with UXLINK tokens and refraining from trading on decentralized exchanges due to the compromised supply. Protocols employing multi-signature wallets must undertake rigorous security audits, with a particular focus on delegateCall implementations and access control mechanisms, to prevent similar administrative bypasses. This incident will likely drive new best practices in smart contract auditing, emphasizing the immutable nature of core administrative functions and the need for robust supply control in token contracts. The potential for contagion risk extends to any protocol with similar multi-signature wallet architectures or delegateCall patterns that have not been thoroughly vetted.
