UXLINK Multi-Signature Wallet Compromised, $11 Million Drained and Tokens Minted ∞ Security

A sleek, metallic structure, possibly a hardware wallet or node component, features two embedded circular modules depicting a cratered lunar surface in cool blue tones. The background is a blurred, deep blue, suggesting a cosmic environment with subtle, bright specks

The image showcases a high-precision hardware component, featuring a prominent brushed metal cylinder partially enveloped by a translucent blue casing. Below this, a dark, wavy-edged interface is meticulously framed by polished metallic accents, set against a muted grey background

Briefing

On September 23, 2025, the UXLINK decentralized social project experienced a severe security incident where attackers compromised its multi-signature wallet, resulting in the theft of over $11 million in various digital assets. This breach was compounded by the unauthorized minting of an additional 1 billion UXLINK tokens on the Arbitrum chain, which caused the token’s market value to drop by nearly 65% overnight. The immediate consequence for the protocol was a significant loss of capital and a drastic devaluation of its native token, highlighting a critical failure in access control mechanisms.

A polished blue, geometrically designed device, featuring a prominent silver and black circular mechanism, rests partially covered in white, fine-bubbled foam. The object's metallic sheen reflects ambient light against a soft grey background

Context

Prior to this incident, the prevailing risk factors in the DeFi landscape included vulnerabilities in multi-signature wallet implementations and inadequate access control logic within smart contracts. Such vulnerabilities, if not rigorously audited and secured, present an attractive attack surface for malicious actors seeking to manipulate protocol functions like token minting or asset transfers. The incident underscores the persistent threat posed by compromised administrative keys or flawed governance mechanisms in decentralized systems.

A highly detailed render showcases intricate glossy blue and lighter azure bands dynamically interwoven around dark, metallic, rectangular modules. The reflective surfaces and precise engineering convey a sense of advanced technological design and robust construction

Analysis

The incident’s technical mechanics involved the compromise of UXLINK’s multi-signature wallet, where attackers gained unauthorized control over administrative privileges. Specifically, the attacker utilized a delegateCall operation to remove existing administrator permissions and subsequently invoked addOwnerWithThreshold to establish new, malicious control. This enabled the illicit transfer of approximately $11.3 million in assets, including USDT, USDC, WBTC, and ETH, which were then bridged and swapped across Ethereum and Arbitrum. Following the asset drain, the attackers leveraged their newfound control to mint an additional 1 billion UXLINK tokens on Arbitrum, exacerbating the financial impact and market instability.

A prominent clear spherical object with an internal white circular panel featuring four distinct circular indentations dominates the center, set against a blurred backdrop of numerous irregularly shaped, faceted blue and dark grey translucent cubes. The central sphere, a visual metaphor for a core protocol or secure enclave, embodies a sophisticated governance mechanism, possibly representing a decentralized autonomous organization DAO or a multi-signature wallet's operational interface

Parameters

Protocol Targeted ∞ UXLINK
Vulnerability ∞ Multi-signature wallet compromise, unauthorized minting
Financial Impact ∞ Over $11 million in initial asset drain, plus 1 billion tokens minted
Blockchain(s) Affected ∞ Ethereum, Arbitrum
Date of Incident ∞ September 23, 2025
Initial Assets Stolen ∞ $4 million USDT, $500,000 USDC, 3.7 WBTC, 25 ETH

The image displays a close-up of a sleek, transparent electronic device, revealing its intricate internal components. A prominent brushed metallic chip, likely a secure element, is visible through the blue-tinted translucent casing, alongside a circular button and glowing blue circuitry

Outlook

In response to this breach, UXLINK is initiating a token swap and developing a compensation plan for affected users, while emphasizing that individual user wallets remain secure. Immediate mitigation steps for similar protocols include a comprehensive re-evaluation of multi-signature wallet security, particularly focusing on delegateCall and addOwnerWithThreshold functions. This incident will likely reinforce the necessity for stringent smart contract audits, enhanced access control protocols, and the integration of hardware wallets for critical asset storage, setting new benchmarks for operational resilience in the DeFi ecosystem.

The UXLINK multi-signature wallet compromise and subsequent token minting underscore the paramount importance of robust access control and continuous security audits in safeguarding decentralized finance protocols against sophisticated exploitation.

Signal Acquired from ∞ binance.com