UXLink attacker cashes out $23 million in 1 hour, stolen assets are accelerating their exit

UXLink attacker is accelerating the liquidation of stolen assets. According to the latest reports, ChainShield monitoring shows that this address exchanged 248 WBTC for 23 million DAI within the past hour. This is the largest fund transfer by the attacker since the hacking incident on September 22, 2024.

What the attacker is doing

Single liquidation exceeding $23 million

Based on monitoring data, the attacker completed this transaction in just one hour. With the current WBTC price around $93,242, the 248 WBTC are worth approximately $23.12 million, which roughly matches the 23 million DAI exchanged. This indicates that the attacker is systematically converting high-volatility WBTC into relatively stable USD-pegged stablecoins.

Background: A large-scale exploit

The funds being liquidated originate from the UXLink attack on September 22, 2024. During that incident, the attacker minted billions of unauthorized tokens, stealing crypto assets worth tens of millions of dollars. Since then, these stolen funds have remained in the attacker’s address. The current liquidation activity suggests the attacker is now beginning to cash out these assets.

Why this matters

This is just the beginning

From the attacker’s behavior pattern, this liquidation may only be the start of a phased exit. Large exchanges within a short period indicate the attacker has planned the fund transfer. Notably, converting to stablecoins like DAI is often for easier subsequent transfer or withdrawal.

On-chain monitoring value

Security agencies like ChainShield can track such large abnormal transactions in real-time, which is crucial for risk prevention. By sharing this information publicly, the community can stay alert to potential follow-up liquidation activities.

What to watch for next

Based on current information, several ongoing monitoring directions include:

• Whether the attacker continues to perform large-scale liquidations
• The final destination of the stolen funds (possibly involving mixers or cross-chain transfers)
• Whether law enforcement agencies intervene to freeze these assets
• Abnormal activities in other WBTC holding addresses

Summary

UXLink attacker is actively liquidating stolen assets, with a single transaction exceeding $23 million. This indicates the stolen funds are accelerating their exit, shifting from high-volatility assets to stablecoins. Although this is just one transaction within the past hour, considering the original attack scale of tens of millions of dollars, more liquidation actions may follow. For on-chain security monitoring and law enforcement, this is an important signal, requiring close attention to the attacker’s subsequent moves.