The exploiter behind the September 2025 UXLINK hack has converted 5,496 ETH into approximately $11.82 million worth of DAI stablecoin within a single hour, signaling a potential acceleration in the attacker’s efforts to liquidate stolen funds.
The large-scale swap was flagged by on-chain watchers tracking the wallet tied to the original UXLINK exploit. The conversion of 5,496 ETH into DAI, a decentralized stablecoin, represents one of the most significant single movements from the exploiter’s wallet since the initial attack.
This latest activity follows earlier reports that the hacker had already begun moving stolen funds and selling ETH in smaller batches, with prior transactions totaling roughly $6.8 million in ETH sales. The pace has now clearly escalated.
How the September 2025 UXLINK Exploit Unfolded
UXLINK was hit on September 22, 2025, in an exploit that compromised the protocol and allowed the attacker to drain substantial funds. According to early reporting on the incident, the attacker was able to mint billions of UXLINK tokens during the breach, which were then converted into ETH and other assets.
The scale of the original theft dwarfs the $11.82 million moved today. The attacker has been gradually converting stolen assets over the months since the hack, a pattern consistent with exploiters who aim to avoid triggering major price slippage or drawing immediate attention from automated tracking tools.
UXLINK’s token price suffered a sharp decline following the September exploit. The project has yet to fully recover, and periodic large sell-offs from the exploiter’s wallet continue to weigh on market confidence, similar to how other major protocol breaches like the Bittensor ecosystem have seen security concerns affect token valuations.
Why DAI Instead of USDC or USDT
The choice of DAI as the output token is deliberate. Unlike USDC and USDT, which are issued by centralized entities (Circle and Tether respectively), DAI is a decentralized stablecoin governed by MakerDAO. This distinction matters because centralized stablecoin issuers can freeze assets in wallets flagged for illicit activity.
Tether and Circle have both cooperated with law enforcement in the past to blacklist addresses linked to hacks and exploits. DAI, by contrast, cannot be frozen by any single party, making it the preferred stablecoin for actors seeking to avoid asset seizure.
Converting ETH to a stablecoin also eliminates exposure to ETH price volatility. By locking in $11.82 million at current ETH prices, the exploiter ensures the value of these funds won’t decline if ETH drops, a move that suggests preparation for the next stage of fund movement.
What Comes Next for the Stolen Funds
On-chain analysts tracking exploit proceeds have identified common patterns that typically follow large stablecoin conversions. These include routing funds through mixing protocols, bridging assets to alternative blockchains, or moving funds through decentralized exchanges in smaller increments to obscure the trail.
The broader DeFi ecosystem continues to grapple with the challenge of stolen funds circulating through decentralized protocols. While on-chain transparency means every transaction is publicly visible, the decentralized nature of protocols like DAI and cross-chain bridges makes actual fund recovery difficult without the exploiter’s cooperation.
Readers tracking the situation can monitor the exploiter’s wallet activity through Etherscan. Prior movements from this address, including the earlier $6.8 million ETH sale, suggest the attacker is accelerating the liquidation timeline.
ON-CHAIN DATA
- Amount swapped: 5,496 ETH
- Output: ~$11.82M DAI
- Timeframe: Approximately 1 hour
- Original exploit date: September 22, 2025
Whether UXLINK’s team or law enforcement can intervene before additional funds are moved remains an open question. The project has not issued a public statement regarding this latest wave of activity. As geopolitical uncertainty continues to shape broader market dynamics, protocol security incidents like this one serve as a reminder of the risks still embedded in decentralized finance.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.