Wallet Tied to $42M UXLINK Exploit Unwinds $148M in Hyperliquid Positions

A trader on Hyperliquid whose wallet on-chain analysts linked to the September 2025 exploit of the SocialFi project UXLINK has begun liquidating $148 million in open leveraged positions, according to on-chain records cited by the tracking service EmberCN.

The address launched a 16-hour TWAP (time-weighted average price) algorithm on November 9 to wind down the book. The algorithm is scheduled to finish by 06:00 GMT on November 10, which gives the market a hard deadline for the unwind.

What is the trader holding?

The book spans three large long positions across the major liquid tokens:

• Ethereum: a long of 30,282 ETH worth roughly $55.46 million, with a liquidation price of $1,740.
• Solana: a 550,000 SOL long at 10x leverage, which faces full liquidation if SOL falls to $65.6.
• XRP: 35.03 million tokens worth around $35 million, with a liquidation price of $0.94.

The programmed selling is already pressuring the prices of all three assets, per on-chain data. For a venue like Hyperliquid, a forced unwind of this size is an operational event, not just a price move: it concentrates liquidation risk in a single book and tests the exchange's engine while the TWAP feeds supply into the market hour after hour.

The trader now sits on a net loss of $3.3 million. That's a sharp reversal. The same address was previously considered the most profitable account on Hyperliquid, and the recent market downturn wiped out what had been a substantial cushion of gains.

How did the wallet get here?

The provenance of the funds is what turns a large liquidation into an enforcement-adjacent story. In September 2025, UXLINK — a crypto social network with Telegram integration — suffered a hack in which attackers exploited the project's multisig infrastructure. They drained the treasury and minted new tokens. The combined damage from the exploit and the subsequent collapse of the UXLINK token price was estimated at roughly $42 million.

In August 2026, an anonymous trader deposited $11.54 million in USDC on Hyperliquid. EmberCN traced the wallet that paid gas fees for that account and found it had received ETH from addresses that previously held stolen UXLINK funds — the on-chain thread connecting today's sell-off to last year's exploit.

From that deposit, the trader ran an unusually profitable campaign, closing five winning trades for a net gain of $5.71 million. As recently as the end of October, the Ethereum position alone carried $5.6 million in unrealized profit.

The market downturn erased it. Most of the trader's remaining capital is now at risk of liquidation if any of the three positions breaches its trigger price before the TWAP completes.

What happens next?

The unwind window closes at 06:00 GMT on November 10. Until then, the market has a visible supply schedule in ETH, SOL and XRP, and liquidation levels at $1,740, $65.6 and $0.94 that mark the outer boundary of the trader's runway. Whether the linked wallet draws formal follow-up from investigators tracing the UXLINK stolen funds is the open question once the positions are gone.