UXLINK has finalized a new smart contract audit and is moving forward with a token migration after last week’s exploit, which saw attackers drain millions and mint billions of tokens.
What Happened
On September 22, hackers exploited a delegateCall vulnerability in UXLINK’s multi-signature wallet. The breach allowed them to take admin control, transferring around $11.3 million in assets, including ETH, WBTC, and stablecoins. They also minted between 1 and 2 billion UXLINK tokens on Arbitrum.
Roughly 490 million of those tokens were sold off, bridged to Ethereum, and converted into about 6,732 ETH. The sell-off crushed UXLINK’s price by more than 70%, dropping it from $0.30 to $0.09.
While some assets were frozen by major exchanges like Upbit, the exploit still caused significant damage. Security firm PeckShield and law enforcement joined the investigation shortly after.
The Fix: New Token Contract and Migration
In an update posted on September 24, the UXLINK team confirmed its new Ethereum-based contract had passed audit and would soon be deployed on mainnet.
Key changes include:
- Fixed token supply to align with the original whitepaper.
- Mint–burn function removed to prevent repeat exploits.
- Cross-chain interoperability handled via partners instead of native minting.
The migration plan will swap compromised tokens for new ones, restoring supply integrity and rebuilding trust. Centralized exchanges have been briefed, with most pledging support or temporarily pausing trading to help coordinate the swap.
The Twist: Hacker Gets Phished
In an unexpected turn, the attacker themselves became a victim. On-chain sleuths and ScamSniffer flagged that the exploiter later approved malicious contracts linked to the Inferno Drainer phishing network. As a result, they lost about 542 million UXLINK, including one transfer of over 433 million tokens.
Although the phish reduced the attacker’s stash, they had already made substantial profits from the exploit.
Looking Ahead
The UXLINK team has promised transparency, compensation for affected community members, and ongoing recovery efforts for frozen addresses. The audited contract and migration mark the next step toward stabilizing the project after the shock exploit.
Users are urged to follow only official channels for instructions as the migration begins.
