UXLINK Hacker Swaps $6.4M WBTC to ETH, Routes Funds Through Tornado Cash

The hacker behind the recent UXLINK exploit has made a notable move, swapping 92 Wrapped Bitcoin (WBTC) valued at roughly $6.4 million for 3,248 Ether ($ETH). Blockchain security firm PeckShield flagged the transaction on X (formerly Twitter) on Sept. 26, 2025. Funds Directed Through Privacy Mixer Shortly after the swap, the perpetrator deposited 1,500 $ETH into Tornado Cash, a cryptocurrency mixing service designed to obscure transaction trails. It remains a popular choice for attackers looking to make funds harder to trace, much to the frustration of law enforcement and blockchain analysts. The remaining $ETH sits in wallets linked to the hacker, still under watch. The move is part of a broader effort to launder the proceeds from the UXLINK exploit, which occurred on Sept. 22, 2025. During the initial breach, attackers drained approximately $44 million in various assets from UXLINK, a decentralized identity and social networking platform built on the blockchain. Timeline of the Exploit On Sept. 22, UXLINK confirmed a security incident involving unauthorized access to certain smart contract functions. The project paused operations and urged users to revoke contract approvals. PeckShield and other security firms immediately began tracking the stolen funds, which included a mix of $ETH, stablecoins, and other tokens. The hacker’s decision to convert WBTC into $ETH is a strategic one: $ETH offers greater liquidity and is easier to move through privacy tools like Tornado Cash. Why This Matters for Crypto Users The incident highlights the persistent risks tied to DeFi protocols and the value of timely security audits. For UXLINK users, the exploit serves as a reminder to monitor wallet approvals and consider hardware wallets for long-term storage. The use of Tornado Cash also underscores ongoing regulatory debates about privacy tools, which have faced sanctions and scrutiny in the United States and elsewhere. As of press time, UXLINK has not announced any recovery plans or compensation for affected users. The project’s native token has experienced volatility since the breach, though trading volumes remain active. Conclusion The movement of $6.4 million in WBTC to $ETH and subsequent deposit into Tornado Cash marks a significant step in the hacker’s laundering process. Blockchain analysts continue to monitor the remaining wallets, while the broader crypto community watches for further developments. The incident adds to a growing list of high-profile DeFi exploits in 2025, reinforcing the need for stronger security measures across the ecosystem. FAQs Q1: What is UXLINK? UXLINK is a decentralized identity and social networking protocol built on the blockchain. It allows users to manage digital identities and social connections in a decentralized manner. Q2: How much was stolen in the UXLINK exploit? Approximately $44 million in various cryptocurrencies was stolen on Sept. 22, 2025, according to initial reports from the project and security firms. Q3: Why did the hacker swap WBTC for $ETH? $ETH offers greater liquidity and is more commonly accepted by privacy mixing services like Tornado Cash, making it easier to launder stolen funds compared to WBTC. Q4: What is Tornado Cash? Tornado Cash is a cryptocurrency mixing service that enhances transaction privacy by breaking the on-chain link between source and destination addresses. It has been a target of regulatory action in the U.S. Q5: Can the stolen funds be recovered? Recovery is challenging once funds enter a mixer like Tornado Cash. However, law enforcement and blockchain analytics firms continue to track wallet addresses and may identify the perpetrator over time.