Overview

• Security firms and UXLINK confirm a delegateCall exploit on Sept. 22 that compromised a multisig wallet, enabled unauthorized transfers worth about $11.3 million, and allowed large‑scale token minting.
• UXLINK’s token fell more than 70% following the incident as hundreds of millions of illicitly minted tokens were sold across DEXs and CEXs and proceeds were bridged to Ethereum.
• On Sept. 24, UXLINK said the replacement Ethereum contract passed audit, sets a fixed supply, drops mint‑burn capabilities, and will underpin an emergency token swap coordinated with exchanges.
• The exploiter later lost about 542 million UXLINK (roughly $43–50 million) to a phishing drain tied by researchers to Inferno Drainer after signing a malicious approval.
• Exchanges have frozen suspect deposits and authorities were notified, while the attacker continues to move funds, including swapping 1,620 ETH for about $6.8 million in DAI.