Briefing
A significant security incident impacted the UXLINK protocol, stemming from a delegate call vulnerability within its multi-signature wallet that granted administrative control to a malicious actor. This critical flaw enabled the unauthorized minting of nearly 10 trillion CRUXLINK tokens on the Arbitrum blockchain, leading to an immediate 70% price collapse and the draining of approximately $11.3 million in various assets, including stablecoins and wrapped Bitcoin. In an unexpected turn, the original exploiter subsequently fell victim to a sophisticated phishing attack by the Inferno Drainer group, resulting in the loss of 542 million UXLINK tokens, valued at an estimated $43-48 million.
Context
Prior to this incident, the prevailing attack surface in decentralized finance (DeFi) often included vulnerabilities in smart contract logic and insufficient access controls, particularly within multi-signature wallet implementations. While multi-signature wallets are generally considered a robust security measure, misconfigurations or unvetted code can transform them into critical points of failure, enabling administrative bypasses and unauthorized asset manipulation. This incident leveraged such a fundamental weakness, underscoring the persistent risk associated with complex contract interactions and permissioned functions.
Analysis
The incident’s technical mechanics originated from a delegate call vulnerability embedded within UXLINK’s multi-signature wallet. This exploit allowed the attacker to manipulate the contract’s permissions, effectively removing existing administrators and installing their own address as the wallet’s owner, thereby gaining full administrative access. With this elevated privilege, the attacker proceeded to mint an enormous quantity of CRUXLINK tokens ∞ nearly 10 trillion on the Arbitrum blockchain ∞ and then liquidated these newly created assets, alongside existing holdings of USDT, USDC, WBTC, and ETH, across decentralized exchanges. This chain of cause and effect, from a specific code vulnerability to administrative control and subsequent asset manipulation, was successful due to the critical flaw in the multi-signature wallet’s delegate call function, which lacked adequate validation or access control mechanisms.
Parameters
- Protocol Targeted ∞ UXLINK
- Attack Vector ∞ Delegate Call Vulnerability in Multi-Signature Wallet
- Initial Financial Impact ∞ ~$11.3 Million Drained, 70% Token Price Drop
- Secondary Financial Impact ∞ Attacker Lost ~$43-48 Million to Phishing
- Blockchain Affected ∞ Arbitrum
- Vulnerability Type ∞ Smart Contract Logic, Access Control
- Date of Initial Exploit ∞ September 22-23, 2025
- Secondary Attacker Group ∞ Inferno Drainer
Outlook
Immediate mitigation for UXLINK users involves adhering to official announcements regarding token migration and refraining from trading the compromised token on decentralized exchanges. This incident will likely catalyze a renewed focus on rigorous smart contract auditing, particularly for multi-signature wallet implementations and delegate call functions, to prevent similar administrative privilege escalation. Furthermore, the “hacker-on-hacker” phishing event highlights the pervasive and evolving nature of social engineering threats, emphasizing that even sophisticated malicious actors are susceptible. This underscores the need for continuous security education and multi-layered defenses across the entire digital asset ecosystem, from protocol design to individual operational security.