UXLink exploiter launders $8.1M through Tornado Cash, because privacy mixers never sleep 🌪️

The attacker behind the September 2025 UXLink exploit has resurfaced, moving roughly $8.1 million in Ether into Tornado Cash in an apparent effort to obscure the transaction trail. According to on-chain investigator Specter, the wrongdoer first converted stolen DAI stablecoins into ETH before executing 46 distinct deposits of 100 ETH each into the mixing protocol. The latest activity brings the total amount laundered from the exploit to $19.1 million, though investigators note the attacker retains control of approximately $16 million in additional funds that have not yet been routed through a mixer.

The original UXLink exploit occurred in September 2025, when the attacker minted more than 9 trillion $UXLINK tokens, an amount the project described as over $800 billion at the time. The exploiter subsequently moved proceeds to centralized exchanges and offloaded fraudulent tokens through decentralized venues, a process that drained liquidity from Uniswap pools associated with the token. The attacker also signed a malicious transaction that resulted in the loss of 542 million $UXLINK tokens to a second actor in an incident often characterized as "theft stolen from theft." Even after that setback, the primary exploiter retained roughly 900 million $UXLINK tokens, leaving a substantial share of the compromised supply in the hands of malicious actors.

The renewed laundering activity coincided with ETH trading at $1,745.11, down 1.01% over the prior 24 hours. Separately, on June 12 Humanity Protocol disclosed a targeted phishing attack against one of its directors, in which stolen administrative credentials were used to upgrade contracts, transfer tokens across Ethereum, and mint new $H tokens on the BNB Smart Chain. Three days later, on June 15, a suspicious transaction drained approximately $2.19 million from Aztec Network's Router contract, adding to a string of incidents across the Web 3 sector.