Trader Linked to UXLINK Hack Begins Closing Long Positions Worth About $148 Million
Key Facts
A trader linked to the UXLINK project hack has begun closing long positions worth about $148 million on Hyperliquid, according to a KuCoin report citing Huo Xing Finance and on-chain monitoring by EmberCN. The positions comprise Ethereum, Solana and XRP, and the trader opened them in August of the same year, the report said. The report said the positions are being closed in batches using a time-weighted average price tool, as part of a plan spanning 16 hours. It estimated a loss of about $3.3 million if the positions are fully closed. That puts the loss within the bounds of an estimate conditional on completing the close, as the trader has begun the process and the report did not say the entire positions had already been liquidated.
The positions comprise 30,282 units of Ethereum, 550,000 units of Solana and 35.03 million units of XRP, according to details in the KuCoin report. This means the announced close covers three digital assets, rather than a single position in one coin. The report said the long positions were opened in August and are worth about $148 million in total. It does not break down the value of each position separately in the figures cited here, but specifies the amounts of the assets being traded. The plan is being executed gradually through the tool cited in the coverage, rather than through an announcement of a full and immediate liquidation.
The closing process is expected to take 16 hours and to be completed at around 6:00 a.m. on November 10, 2026, according to the report. That is the expected time for completing the full liquidation under the plan, not confirmation that the close is complete. The batch execution method allows orders to be distributed over the specified period, while the final outcome remains contingent on completing the process as described in the report. The report tied its estimated loss of about $3.3 million to the assumption that the positions would be fully closed. The figure therefore remains an estimate of the loss upon completion, not a realized final result at the start of the close.
EL7 data show Ethereum's daily close at $2,127.46 on November 8, compared with a close of $2,240.24 on November 7. Solana also closed at $86.54 on November 8, after $89.81 the previous day. XRP posted a daily close of $1.1132 on November 8, versus $1.164 on November 7. These three closing prices place the assets' moves on two consecutive days before the closing plan announced on November 9. They are daily price data that do not on their own determine the effect of the trader's orders on the market, nor attribute the price moves to these positions.
The trader's link to the UXLINK hack stems from the attack covered in a KuCoin report dated September 24, 2025. The report said an attacker minted billions of unauthorized UXLINK tokens and said the project announced a plan to swap the tokens to a new contract. It also said the attack exploited a vulnerability in UXLINK's multisignature wallet and estimated the stolen assets at about $30 million. This record provides context for linking the address whose positions the report tracks to the earlier attack, with that connection attributed to EmberCN's on-chain monitoring as cited in the coverage. The closing plan is expected to end at around 6:00 a.m. on November 10, according to the schedule cited in the report.