UXLink-linked wallet unwinds $148M in leveraged positions on Hyperliquid
A wallet tied by on-chain analysts to the UXLink exploiter has begun closing roughly $148 million in leveraged long positions on Hyperliquid, according to EmberCN’s on-chain monitoring post.
UXLINK 黑客开始平多他在 Hyperliquid 上价值 $1.48 亿的多仓！包括 30,282 枚 ETH、55 万枚 SOL、3503 万枚 XRP。
◎UXLINK 黑客 8 月份在 Hyperliquid 上开多了 ETH、SOL、XRP，价值约 $1.48 亿。
◎今天 2 小时前，他开始通过 TWAP 工具设置在 16 个小时里平掉所有的多单。大约到明天早上 6… https://t.co/bLzJu3P6hN pic.twitter.com/dG3fGXWgvz— 余烬 (@EmberCN) November 9, 2026
The positions span Ethereum, Solana and XRP, with the wallet reported to be unwinding 30,282 ETH, 550,000 SOL and 35.03 million XRP through a 16-hour TWAP order. PublicAML also said it traced funding wallets and found an indirect link to the earlier exploit through an Aug. 28 burner address.
According to the monitoring cited in the post, the positions were opened in August and are being reduced gradually rather than liquidated all at once. The TWAP structure suggests the wallet is trying to exit over time, though the on-chain data does not by itself establish why the positions are being closed.
On-chain links point back to earlier exploit wallets
PublicAML said the address appears connected to the prior UXLink exploit through funding and gas-wallet activity, including an indirect route via a burner address created on Aug. 28. The same monitoring also said the current unwind is taking place on Hyperliquid, where the leveraged book was built up earlier this year.
The reported move does not, on its own, confirm whether the wallet owner is the exploiter, an associated party or another entity with access to the same funding trail. What the data does show is a large derivatives position being reduced across three major tokens through an automated execution method over a set time window.
Because the unwind is being carried out via TWAP, the execution appears designed to spread sales across the 16-hour period rather than hit the market all at once. No additional confirmation was provided in the materials about the final outcome of the order or whether any portion of the position remains open.
