zkLink reported a loss of approximately $783,100 on October 29, 2026, after an attacker exploited a vulnerability in its Arbitrator contract. The breach allowed fraudulent withdrawals through the Arbitrator.claimMessage function, according to security commentary highlighted by SlowMist. The incident underscores persistent smart contract risks and may pressure investor confidence in the protocol.
Separately, on-chain analyst Yu Jin, also known as Ember, identified a Hyperliquid trading account potentially linked to the September 2025 UXLINK exploit. The account held a leveraged Ethereum perpetual position of about 30,282 ETH with an average entry price of $2,134.45 and a notional value near $71.17 million. Unrealized profits were estimated at $6.54 million, while completed trades had generated roughly $5.71 million in realized gains. The account was funded with about 11.54–11.55 million USDC in early August 2026.
The address overlap with the UXLINK attacker remains circumstantial: both transferred remaining ETH for gas to the same wallet on the same day. The original UXLINK incident, occurring on September 22, 2025, involved a delegateCall-related multisignature vulnerability and resulted in estimated losses of $40 million to $48 million, plus unauthorized token minting that disrupted UXLINK’s supply and price.
Neither event has been conclusively linked to a single actor, and the Hyperliquid profits are unrealized. Still, the disclosures highlight security vulnerabilities and surveillance difficulties across decentralized platforms.
