Incident All ledgers
UXLINK: $11.3m
UXLINK lost $11.3m on 22 September 2025. Ranked 183rd of 1,272 crypto failures, with method, returned funds and comparable incidents.
- Date
- 22 September 2025
- Lost
- $11.3m
- Returned or repaid
- None recorded
- Target
- DeFi Protocol
- Category
- Access Control
- Method
- Delegatecall Hijack
- Chains
- Ethereum, Arbitrum
An attacker abused a delegatecall flaw in UXLINK's multisig wallet to change its owners without signer approval, draining about $11.3M in stablecoins, ETH and WBTC. The attacker also seized and minted large amounts of UXLINK tokens, and the token fell over 70%.
Against the ledger
- It ranks 183rd of the 1,272 incidents with a known loss, and 21st in 2025.
- It accounts for 10.2% of the $111.2m in known losses in September 2025.
- 225 incidents in the ledger are classified as Access Control, for $1.96bn in total. This one is 0.6% of that.
- The ledger records no returned funds.
Closest in size by the same method
| Date | Target | Lost | Type | Method | Returned |
|---|---|---|---|---|---|
| 28 May 2025 | Cork V1 | $12.0m | DeFi Protocol | Improper Access Control | — |
| 06 Aug 2024 | Ronin Bridge | $12.0m | DeFi Protocol | Uninitialized Proxy | — |
| 02 Jun 2019 | Kraken | $10.4m | CEX | Improper Access Control | — |
| 08 May 2021 | Rari Capital | $10.0m | DeFi Protocol | Arbitrary External Call | — |
| 05 May 2021 | ValueDefi | $10.0m | DeFi Protocol | Improper Access Control | — |
All failures in 2025 · The failures ledger
Amounts are DefiLlama’s estimates and can change as incidents are revalued. Its returned figure can include money a company repaid itself, not only funds recovered from attackers. Source: DefiLlama.
Cite this Bitminer.io, “UXLINK, failures ledger”, data to 2 November 2026, https://bitminer.io/ledger/incident/uxlink-2025-09-22/. How this is built