On-chain investigations reveal that addresses involved in the UXLink attack have transferred funds again. The attackers first converted some of the stolen DAI into ETH, then transferred approximately $8.1 million worth of ETH into the mixing tool Tornado Cash, attempting to further sever the on-chain tracing path.
46 transfers to Tornado Cash
The report, citing investigators, stated that the transfer was divided into 46 transactions, each containing 100 ETH. This type of split transfer is a common practice, designed to mix illicit funds with legitimate transactions, increasing the difficulty of on-chain tracking.
According to the article, the UXLink attackers have so far laundered approximately $19.1 million in stolen assets. However, after completing this round of transfers, the relevant addresses reportedly still control approximately $16 million, meaning that further transfers are possible.
The attack began in September 2025.
The report recalls that the incident first occurred in September 2025. The attackers profited through anomalous minting, involving over 9 trillion UXLINK tokens, and maintained access to continue issuing more tokens hours after the attack.
Subsequently, these aberrant tokens were transferred to centralized exchanges and then sold off through decentralized exchanges, causing the related liquidity on Uniswap to be rapidly depleted.
The article also mentions that the attackers subsequently lost 542 million UXLINK tokens due to signing malicious transactions, which were then transferred by another malicious participant. This type of situation is often referred to as a "double-cross." Even so, the main attackers still held approximately 900 million UXLINK tokens at the time.
Recent security incidents are still increasing.
Besides UXLink, on-chain security incidents continue to occur recently. On June 12, Humanity Protocol disclosed that one of its directors was the victim of a targeted phishing attack. The attackers used this attack to gain administrative privileges, upgrade contracts, transfer tokens across chains, and issue new H tokens on the BNB Smart Chain.
On June 15, suspicious transactions also occurred in Aztec Network's Router contract, involving the outflow of approximately $2.19 million in assets. These successive incidents highlight that contract permissions, administrator accounts, and cross-chain operations remain high-risk aspects of current on-chain security.
