The attacker who exploited the UXLink protocol nine months ago has reactivated, sending approximately $8.1 million in stolen Ether to the privacy mixer Tornado Cash. The movement of funds marks the first known activity from the exploiter since the original breach, reigniting concerns over asset recovery and on-chain forensic capabilities.
UXLink, a decentralized social platform, suffered the initial exploit in early 2024, with losses reported in the millions. On-chain data from Etherscan shows the attacker transferred 2,600 ETH across multiple transactions to Tornado Cash, a tool often used to obfuscate fund trails. The timing of the transfer suggests the exploiter may be attempting to liquidate or launder the remaining haul after a prolonged dormant period.
Regulatory scrutiny around crypto mixing services has intensified globally. The U.S. Treasury’s Office of Foreign Assets Control sanctioned Tornado Cash in 2022, alleging it facilitated money laundering for North Korean-linked hackers. This latest transaction could attract renewed attention from law enforcement, especially given the size of the transfer and the mixer’s sanctioned status.
The token price of UXLink showed minimal immediate reaction to the news, trading flat over the past 24 hours. The protocol’s market capitalization remains under $10 million, reflecting the diminished footprint of a project still recovering from the reputational damage of the exploit. Bitcoin and Ethereum traded sideways during the period, suggesting the event had limited broader market impact.
Community responses have been mixed. Some UXLink supporters expressed frustration over the attacker’s ability to move funds undetected for months, while others called for improved on-chain monitoring and faster collaboration between protocols and security firms. Competing decentralized social platforms, such as Lens Protocol and Farcaster, have not commented on the incident.