Briefing
A critical delegate call vulnerability within UXLINK’s multi-signature wallet enabled an attacker to gain administrative control, leading to the unauthorized minting of approximately 10 trillion CRUXLINK tokens and the subsequent exfiltration of assets. This exploit, occurring on September 22-23, 2025, caused the CRUXLINK token to plummet over 70% and resulted in millions of dollars in losses from liquidity pools. In an unprecedented turn, the initial attacker later became a victim themselves, losing an estimated $43 million of the stolen UXLINK tokens to a sophisticated phishing attack orchestrated by the Inferno Drainer group.
Context
Prior to this incident, multi-signature wallets, while designed for enhanced security through multiple approvals, have consistently presented an attack surface when misconfigured or containing faulty code. The prevailing risk factors include vulnerabilities in call protocols that can escalate to administrative-level control, alongside human element risks such as phishing or private key compromise. The UXLINK exploit leveraged a known class of smart contract vulnerability, underscoring the persistent need for rigorous auditing and secure contract design in complex DeFi protocols.
Analysis
The incident’s technical mechanics centered on a delegate call vulnerability embedded within UXLINK’s multi-signature wallet contract. This flaw permitted the attacker to invoke delegatecall with malicious parameters, effectively granting administrative privileges and bypassing intended access controls. With elevated permissions, the attacker proceeded to mint an unauthorized volume of CRUXLINK tokens on the Arbitrum blockchain, subsequently liquidating these newly created assets for more stable cryptocurrencies like ETH and USDC, thereby draining liquidity pools and devaluing the native token. The attacker then engaged in extensive on-chain shuffling, converting approximately 1,620 ETH, valued at $6.8 million, into DAI stablecoins to obscure the trail.
Parameters
- Protocol Targeted ∞ UXLINK
- Initial Attack Vector ∞ Delegate Call Vulnerability in Multi-Signature Wallet
- Primary Blockchain Affected ∞ Arbitrum
- Initial Financial Impact ∞ Approximately 10 trillion CRUXLINK tokens minted, causing over 70% token crash; $6.8 million ETH converted to DAI by attacker.
- Secondary Attack Vector (on Attacker) ∞ Phishing Attack
- Secondary Financial Impact (on Attacker) ∞ $43 million in UXLINK tokens lost to Inferno Drainer.
- Incident Start Date ∞ September 22, 2025
Outlook
Immediate mitigation for users involves exercising extreme caution with any UXLINK-related transactions and awaiting official guidance on token migration. This incident highlights the critical need for protocols to implement continuous security monitoring, robust smart contract audits, and multi-layered defense strategies, especially for core infrastructure like multi-signature wallets. The “hacker-on-hacker” element further emphasizes that even sophisticated threat actors are susceptible to social engineering, reinforcing the universality of fundamental cybersecurity hygiene. This event will likely prompt renewed calls for stricter regulatory oversight and enhanced industry standards for wallet security and token minting procedures across the DeFi ecosystem.
