Briefing
On September 22, 2025, the UXLINK Web3 social infrastructure project experienced a severe security incident, with attackers exploiting a critical delegateCall vulnerability within its multi-signature wallet. This compromise led to the unauthorized minting of approximately 2 billion UXLINK tokens and the illicit transfer of $11.3 million in assets, including stablecoins, ETH, and WBTC. The immediate consequence was a drastic 70% collapse in the UXLINK token’s value, resulting in a $70 million reduction in market capitalization. The incident further escalated with the original exploiter subsequently falling victim to a phishing attack by the “Inferno Drainer” group, losing $48 million in stolen UXLINK tokens.
Context
Prior to this incident, the decentralized finance (DeFi) sector has been consistently exposed to systemic risks stemming from complex smart contract interactions and the centralized points of control often inherent in multi-signature wallet designs. The delegateCall function, while powerful for upgradability and modularity, introduces a significant attack surface if not meticulously secured and audited. The prevailing threat landscape includes sophisticated exploits targeting logical flaws in contract execution and social engineering tactics like phishing, which continue to compromise even technically adept actors.
Analysis
The attack vector leveraged a delegateCall vulnerability within UXLINK’s smart contracts on both Ethereum and Arbitrum. This allowed the malicious actor to execute arbitrary code with the privileges of the multi-signature wallet, effectively seizing administrative control. The attacker removed existing administrators, installed their own address as the new owner, and then proceeded to drain existing assets and mint an additional 2 billion UXLINK tokens, nearly doubling the circulating supply.
These newly minted and stolen tokens were then rapidly sold across decentralized exchanges through six different wallets, converting them into 6,732 ETH, valued at approximately $28.1 million. The subsequent loss of $48 million by the original hacker to an Inferno Drainer phishing scheme underscores the pervasive nature of social engineering threats within the digital asset ecosystem.
Parameters
- Protocol Targeted ∞ UXLINK
- Vulnerability ∞ DelegateCall Exploit in Multi-signature Wallet
- Date of Incident ∞ September 22, 2025
- Financial Impact (Initial Exploit) ∞ $11.3 Million (stablecoins, ETH, WBTC)
- Tokens Minted ∞ Approximately 2 Billion UXLINK tokens
- Token Price Impact ∞ 70% Crash, $70 Million Market Cap Loss
- Financial Impact (Hacker Phishing) ∞ $48 Million (542 million UXLINK tokens)
- Affected Blockchains ∞ Ethereum, Arbitrum
- Recovery Efforts ∞ Emergency Token Swap, Law Enforcement, PeckShield Engagement
Outlook
Immediate mitigation for UXLINK users involves participating in the announced emergency token swap to legitimize holdings and avoid unauthorized tokens. For the broader DeFi ecosystem, this incident reinforces the critical need for rigorous, independent smart contract audits, particularly for complex functions like delegateCall that manage administrative privileges. Protocols must implement robust governance mechanisms and multi-layered security controls to prevent single points of failure. Furthermore, the “Inferno Drainer” incident serves as a stark reminder that even sophisticated threat actors are susceptible to social engineering, emphasizing the universal importance of vigilance against phishing attacks and secure key management practices across all user segments.