Briefing
A critical delegateCall vulnerability within the UXLINK protocol’s multi-signature wallet led to a severe security incident on September 22, 2025. This exploit granted an attacker unauthorized administrative control, enabling the minting of trillions of new CRUXLINK tokens and the draining of existing assets across Ethereum and Arbitrum. The immediate consequence was a 70% collapse in the UXLINK token price, erasing approximately $70 million from its market capitalization, with initial direct losses totaling $11.3 million.
Context
Prior to this incident, the prevailing attack surface in DeFi often included misconfigurations within complex multi-signature wallet implementations, particularly concerning delegateCall functions. While multi-sig wallets are designed to enhance security by requiring multiple approvals, their inherent complexity can introduce unforeseen vulnerabilities if not rigorously audited and continuously monitored. The UXLINK incident leveraged a known class of smart contract vulnerability, highlighting the persistent risk associated with insufficiently shielded administrative functions.
Analysis
The incident’s technical mechanics centered on a delegateCall vulnerability embedded within UXLINK’s multi-signature wallet contract. The attacker exploited this flaw to execute arbitrary code, effectively usurping administrative privileges by replacing legitimate owner addresses with their own. This critical compromise allowed the malicious actor to utilize the addOwnerWithThreshold function, facilitating unauthorized asset transfers and, more significantly, the minting of an estimated 10 trillion new CRUXLINK tokens on the Arbitrum blockchain. The attacker then systematically liquidated these newly minted and stolen assets for ETH, USDC, and other cryptocurrencies, precipitating a rapid devaluation of the UXLINK token and draining liquidity from the protocol.
Parameters
- Protocol Targeted → UXLINK
- Attack Vector → DelegateCall Vulnerability in Multi-Signature Wallet
- Initial Financial Impact → $11.3 Million
- Market Capitalization Loss → $70 Million
- Blockchain(s) Affected → Ethereum, Arbitrum
- Tokens Minted → Approximately 10 Trillion CRUXLINK
- Attacker Funds Lost → $43 Million to Phishing Attack
Outlook
Immediate mitigation for users involved staying informed of official UXLINK communications regarding the token migration and avoiding trading compromised tokens. For protocols, this incident underscores the imperative for comprehensive security audits that extend beyond token contracts to include all associated multi-signature wallet configurations and administrative functions. Implementing robust timelocks on sensitive operations, hard-coding supply caps, and renouncing minting privileges post-launch are critical best practices. This event will likely reinforce calls for stricter regulatory standards, particularly concerning multi-signature wallet security and transparent smart contract auditing, to bolster ecosystem resilience against similar architectural vulnerabilities.
