UXLINK Hack-Linked Wallet Holds $70M ETH Long
A wallet suspected of being linked to the UXLINK hack is holding a long position of about 30,282 ETH on Hyperliquid, worth roughly $70.25 million at its reported average entry price of $2,134. On-chain analyst Yu Jin, also known as Ember, estimates unrealized gains at $5.62 million to $6.54 million as of October 27, 2026.
The wallet has reportedly made six earlier profitable ETH trades on Hyperliquid, realizing a total of $5.71 million. Yu Jin connected it to the UXLINK hack through overlapping fund movements, including a transfer of 11.54 million USDC and shared gas-fee activity. The link is based on on-chain analysis; the wallet’s owner has not been confirmed.
The UXLINK hack took place in September 2025, when an attacker exploited a delegateCall vulnerability in the project’s multisig wallet. Estimated losses were about $40 million, with some reports putting them as high as $48 million. Traders may monitor the large ETH position for signs of an exit, which could add selling pressure, although no sale has been reported.
Neutral
The report has a potentially bearish trading signal for ETH, but it does not establish that the suspected wallet has sold or is about to close its position. A 30,282 ETH long is large enough to attract attention, and a rapid exit could add short-term selling pressure or increase volatility, particularly if liquidity is thin. Conversely, the position is currently long, and its reported unrealized gains do not by themselves imply an imminent sale.
Similar on-chain disclosures about large trader positions or wallets linked to exploits have often prompted heightened monitoring and short-lived volatility, rather than a lasting market move, unless transfers to exchanges or actual order-book activity confirm selling. Traders may therefore watch for wallet movements, Hyperliquid position changes, ETH volume, funding rates and open interest. The UXLINK hack’s lasting significance is primarily a DeFi security and governance concern: the 2025 multisig exploit illustrates how contract vulnerabilities can undermine security controls. On the information available, the direct market impact is uncertain, so neutral is the most appropriate overall classification.