UXLINK Hacker Moves $6.4M in WBTC to ETH, Channels Funds Through Tornado Cash

The hacker responsible for the recent UXLINK exploit has executed a significant fund movement, swapping 92 Wrapped Bitcoin (WBTC) valued at approximately $6.4 million for 3,248 Ether (ETH). The transaction was flagged by blockchain security firm PeckShield, which reported the activity on X (formerly Twitter) on Sept. 26, 2025.

Funds Directed Through Privacy Mixer

Following the swap, the perpetrator deposited 1,500 ETH into Tornado Cash, a cryptocurrency mixing service known for its privacy-enhancing features. This move is a common tactic used by attackers to obfuscate the trail of stolen funds, making it more difficult for law enforcement and blockchain analysts to trace the assets. The remaining ETH from the swap remains under observation in wallets linked to the hacker.

The latest transaction is part of a broader effort to launder the proceeds from the UXLINK exploit, which occurred on Sept. 22, 2025. During the initial breach, attackers drained approximately $44 million in various assets from the UXLINK protocol, a decentralized identity and social networking platform built on the blockchain.

Timeline of the Exploit

On Sept. 22, UXLINK confirmed a security incident involving unauthorized access to certain smart contract functions. The project paused operations and urged users to revoke contract approvals. PeckShield and other security firms immediately began tracking the stolen funds, which included a mix of ETH, stablecoins, and other tokens. The hacker’s decision to convert WBTC into ETH is a strategic move, as ETH offers greater liquidity and is more easily moved through privacy tools like Tornado Cash.

Why This Matters for Crypto Users

This incident highlights the persistent risks associated with DeFi protocols and the importance of timely security audits. For UXLINK users, the exploit serves as a reminder to monitor wallet approvals and use hardware wallets for long-term storage. The use of Tornado Cash also underscores ongoing regulatory debates about privacy tools, which have been subject to sanctions and scrutiny by authorities in the United States and other jurisdictions.

As of press time, UXLINK has not announced any recovery plans or compensation for affected users. The project’s native token has experienced volatility since the breach, though trading volumes remain active.

Conclusion

The movement of $6.4 million in WBTC to ETH and subsequent deposit into Tornado Cash represents a significant step in the hacker’s laundering process. Blockchain analysts continue to monitor the remaining wallets, while the broader crypto community watches for any further developments in the case. The incident adds to a growing list of high-profile DeFi exploits in 2025, reinforcing the need for enhanced security measures across the ecosystem.

FAQs

Q1: What is UXLINK?
UXLINK is a decentralized identity and social networking protocol built on the blockchain. It allows users to manage digital identities and social connections in a decentralized manner.

Q2: How much was stolen in the UXLINK exploit?
Approximately $44 million in various cryptocurrencies was stolen on Sept. 22, 2025, according to initial reports from the project and security firms.

Q3: Why did the hacker swap WBTC for ETH?
ETH offers greater liquidity and is more commonly accepted by privacy mixing services like Tornado Cash, making it easier to launder stolen funds compared to WBTC.

Q4: What is Tornado Cash?
Tornado Cash is a cryptocurrency mixing service that enhances transaction privacy by breaking the on-chain link between source and destination addresses. It has been a target of regulatory action in the U.S.

Q5: Can the stolen funds be recovered?
Recovery is challenging once funds enter a mixer like Tornado Cash. However, law enforcement and blockchain analytics firms continue to track wallet addresses and may identify the perpetrator over time.