The "UXLINK-linked" $45M ETH long on Hyperliquid: the money predates the hack, the owner does not look like a stranger

UXLINK, a Web3 social platform, lost control of its multisig wallet on 22 September 2025; the attacker drained the treasury on Ethereum and BSC and minted UXLINK tokens. On 9 November 2026 PeckShield reported that a Hyperliquid account, 0xDE8d9…d9524, held a 21,550 ETH long at 15x and had been funded with 11 million USDC from 0x35Eb7…5D43, an address that "interacted with the UXLink exploiter" on 28 August. PeckShield itself noted that this indirect link does not prove the trader controls the attacker's wallet. Embers reported the same day that related accounts were closing about $148M of ETH, SOL and XRP longs.

The trader is 0xde8d9e530b0528ffa7b1190f862536c055dd9524. On Hyperliquid it received exactly two transfers, both on 7 August 2026 from 0x7fba7e745bd97f828c824589680749b55a8c04ab: 10 USDC as a test and 11,545,560 USDC six minutes later. The same wallet paid it 0.61 ETH of gas on Arbitrum that day. At 12:06 UTC on 9 November the account held 17,987 ETH long at an average $2,134.45, worth about $3.8M of margin, with liquidation near $1,545.

0x7fba7e745bd97f828c824589680749b55a8c04ab is a private wallet with twelve transactions in its life (our database had it as an Across bridge wallet; that label was wrong and is corrected). It was built up on 26–30 June 2026 from four sources: 45.56 WBTC and 59,895 USDT from 0x679279a70597a422a540ad0541872eda0a840ca2, which had received the WBTC from 0x170880fe741ab5411fb6fe5828a4c82d1493ae92 the same morning; 1,110,995.98 USDC from 0x35eb7bfe079e6c31c78f936057cc418e467d5d43, the address PeckShield named; withdrawals from two busy exchange wallets; and about 29.6 BTC bridged into Hyperliquid through Hyperunit. The WBTC and USDT were swapped to USDC on CoW Swap and sent to Hyperliquid through Circle's CCTP.

0x35eb7bfe079e6c31c78f936057cc418e467d5d43 was funded on 10 January 2025 with about 596 ETH from nine wallets, swapped it to DAI, and parked it in Ethena's sUSDe and Pendle principal tokens; it came out as 1.11M DAI on 21 November 2025 and became the USDC it sent in June 2026. 0x170880fe741ab5411fb6fe5828a4c82d1493ae92 received 3.5M sUSDe in May 2025, held Pendle principal tokens, exited with 4.21M DAI on 21 November 2025 and swapped that to 46.56 WBTC on 2 December 2025. Both balances existed before 22 September 2025. On the chain, the money that pays for the Hyperliquid long is not UXLINK's stolen money.

The two funding wallets act together. On 23 July 2025 0x170880fe741ab5411fb6fe5828a4c82d1493ae92 rolled its Pendle position at 01:21 UTC and 0x35eb7bfe079e6c31c78f936057cc418e467d5d43 did the same at 01:26. On 21 November 2025 they exited at 08:54 and 08:50. On 2 December 2025 0x170880fe741ab5411fb6fe5828a4c82d1493ae92 swapped its DAI to WBTC at 15:31 UTC; the same afternoon, from 14:00 to 14:25, the UXLINK exploiter swapped all 5.38M of its stolen DAI to 702.5 ETH and 38.2 WBTC and sent 700 ETH into Tornado Cash.

The exploiter is 0x5210bfdf0cfe6471322d597d16cf440f5ac59309. On 22 September 2025 the collector 0xb819e6ae5a6668bb0ce02d64d130deca9ff83691 received about 4.0M USDC, 1.38M USDT and 4.73 WBTC from the drained wallets within eight minutes, swapped the stablecoins to DAI on CoW Swap and passed 5,382,418 DAI and the WBTC to the exploiter two hours later. The exploiter swapped DAI to ETH in December 2025 and July 2026 and put about 2,685 ETH into Tornado Cash in 100-, 10- and 1-ETH deposits; its ETH balance is now zero.

The "interaction" PeckShield mentioned is this. On 28 August 2026 at 02:45 UTC the exploiter sent 0.6494 ETH to a fresh wallet, 0xe45642c1ae5d18eff149dc5118e4dc669e15bc26, which swapped it through Mayan fifteen minutes later. At 05:53 the same wallet received 0.414 ETH from 0x35eb7bfe079e6c31c78f936057cc418e467d5d43 and forwarded it at 06:15. The burner lived for three and a half hours and was paid by exactly two senders: the UXLINK exploiter and the operator of the Hyperliquid trader's funding wallets.

Two readings fit the chain. Either the trader's operator and the UXLINK exploiter are the same person, who already had several million dollars in DeFi before the hack, or they are close enough to share a throwaway wallet. A stranger who once received a payment from a hacker does not roll Pendle positions in the same five minutes as another wallet that funds the same account, and does not pay the same three-hour burner as the hacker. Either way, the UXLINK case now has a live, traceable counterparty: a Hyperliquid account with about $3.8M of margin and a large ETH position, funded through Circle's CCTP and Hyperunit, both of which keep records.

It does not say who controls any of these wallets, that the trader's money is stolen, or that Hyperliquid, Circle, CoW Swap, Pendle, Ethena, Mayan or Hyperunit did anything wrong. The hack itself is described by UXLINK, Cyvers, Rekt and The Block; the trader's position is PeckShield's and Embers' report, re-read from Hyperliquid's public API. The funding path, the dates the money first appeared, the lockstep timings, the burner and the exploiter's Tornado deposits are PublicAML's own reading of Ethereum, Arbitrum and Hyperliquid on 9 November 2026. We filed the exploiter, its collector and the burner in our database; the operator's wallets and the trader are marked as linked, not as attackers.