UXLink 黑客试图用盗窃来的ETH像专业人士一样进行交易——最终损失了大部分。

Key Takeaways

The UXLink hacker made repeated high-risk trades instead of safely cashing out stolen funds.

Positions were often held through losses, with exits near breakeven.

The exploit generated over $30 million in ETH, much of which was actively traded. The UXLink hacker has turned out to be surprisingly bad at trading. After stealing tens of millions in cryptocurrency last year, the exploiter spent the past six months actively flipping the stolen ETH and other assets on decentralized exchanges. According to blockchain intelligence firm Arkham, the results haven’t been great. The hacker racked up repeated losses along the way and has only recently managed to crawl back to roughly breakeven. Months of Trading, Little to Show The UXLink exploiter has spent the past six months cycling stolen funds through decentralized exchanges, primarily trading ETH and stablecoins. On-chain data shows the scale of activity. One snapshot reveals nearly 625 individual transactions, with frequent swaps between ETH and DAI using platforms like CoW Swap. The strategy, if it can be called that, followed a pattern. The exploiter often bought into dips, held through volatility, and watched positions slide into losses before exiting—usually only once prices recovered close to breakeven. Arkham’s profit-and-loss data highlights the outcome. At multiple points between October 2025 and early 2026, the wallet sat as much as $4 million in the red. Despite continued trading, there were no sustained gains beyond the original stolen funds. How the Exploit Unfolded The story began in September 2025, when the attacker exploited a smart contract vulnerability in UXLink, an AI-powered Web3 social platform. The breach allowed the exploiter to take control of a multi-signature wallet and drain roughly $11.3 million in assets. The haul included $4 million in USDT, $500,000 in USDC, $3.7 million in wrapped Bitcoin, and smaller amounts of ETH. The attack didn’t stop there. The hacker also minted billions of UXLINK tokens and distributed them across decentralized markets, generating an additional $28 million in ETH. In total, the exploit produced between $30 million and $40 million, though some funds were later lost in a secondary phishing incident. At first, the exit looked clean. Funds were split across dozens of wallets and converted into ETH and stablecoins. But instead of disappearing, the exploiter stayed active. Experts Say Exploiters are Bad at Trading On-chain watchers say this kind of behavior is common among exploiters who treat stolen funds as personal trading accounts.