A cryptocurrency wallet potentially connected to the $40 million UXLINK exploit has accumulated approximately $6.54 million in unrealized profits from a leveraged Ethereum position on decentralized perpetual futures exchange Hyperliquid.The position, identified by on-chain analyst Yu Jin, also known as Ember, involved approximately 30,282 ETH with an average entry price of $2,134.45.According to data circulated on October 27, 2026, the position had a notional value of approximately $71.17 million, reflecting a substantial increase in Ethereum’s price relative to the trader’s entry level.The account attracted attention because blockchain transaction patterns appeared to connect its funding addresses with wallets previously associated with the September 2025 UXLINK security breach. However, investigators have not conclusively established that the account belongs to the attacker or that all funds supporting the position originated from stolen assets.The reported profits also remain unrealized and could change significantly before the position is closed.
Wallet Activity Reveals Large Ethereum Exposure
Yu Jin’s investigation found that the trading account began operating on Hyperliquid in early August 2026 after consolidating approximately 11.54 million to 11.55 million USDC from multiple sources. The account subsequently executed six Ethereum trades, five of which reportedly generated profits.Those completed trades produced approximately $5.71 million in cumulative realized gains, separate from the unrealized profit associated with the latest position. An earlier October 27 snapshot placed the open position at approximately 30,300 ETH, valued near $70.25 million, with $5.62 million in unrealized gains.Later reporting showed the position at 30,282 ETH, valued around $71.17 million, with unrealized gains increasing to $6.54 million. The difference reflects changing market conditions and observation times rather than necessarily indicating a separate trade.The account’s notional exposure substantially exceeds the approximately $11.55 million in USDC initially consolidated, consistent with the use of leveraged derivatives. However, the available reports do not establish its precise leverage ratio, liquidation threshold or current collateral balance.Unlike direct Ethereum ownership, a perpetual futures position provides exposure to price movements without requiring the trader to hold the full underlying asset amount. Consequently, the reported $71 million position should not be interpreted as evidence that the wallet owns 30,282 ETH outright.
Transaction Links Renew Attention on UXLINK Exploit
The suspected connection to UXLINK rests on blockchain activity involving the trading account’s funding infrastructure. According to Yu Jin, an address associated with funding the Hyperliquid position and a previously identified UXLINK attacker address transferred remaining ETH used for transaction fees to the same recipient wallet on the same day.That overlap suggests a possible relationship between the addresses but does not independently prove common ownership. The underlying UXLINK incident occurred on September 22, 2025, when attackers exploited weaknesses associated with the project’s multisignature wallet infrastructure.Security investigations identified unauthorized control involving a delegateCall-related vulnerability. The incident resulted in estimated losses of approximately $40 million, although some assessments placed the broader exposure closer to $48 million.Attackers also minted an enormous quantity of unauthorized UXLINK tokens, severely disrupting the token’s circulating supply and market price. The latest Hyperliquid activity illustrates the difficulties investigators face when tracking assets through multiple addresses, trading platforms and derivatives positions.Public blockchain records can establish transaction relationships and trading activity, but attributing control to a specific individual generally requires additional evidence. The account’s reported trading profits also do not establish that victims of the original exploit have suffered an equivalent additional loss.For market participants, the position represents substantial directional exposure to Ethereum, although its eventual market impact depends on liquidity, execution methods and whether the trader closes or reduces the position. For investigators, the more significant question is whether the address connections can establish control over assets associated with the UXLINK theft.Until that relationship is independently confirmed, the wallet should be described as potentially linked to the exploit rather than definitively controlled by its perpetrator.
