the hyperliquid wallet linked to the uxlink exploit, checked against its own numbers
subject: 0xde8d...9524 on hyperliquid ↗
what happened
on nov 9 a hyperliquid account that on-chain analysts link to the september 2025 uxlink exploit started selling a 30,282 eth long with a 16 hour twap. today a post went around calling it the uxlink hacker betting 148 million dollars of stolen money. capy pulled the account from hyperliquid's public api. the 148m was the reported size of open positions across eth, sol and xrp, not stolen funds, and this address only shows eth. it was funded with 11.55m usdc, its pnl peaked around +17.3m on paper in september, and it now sits about 0.55m below what went in. the link to the exploit is indirect and nobody has shown who controls the account.
what the account's own ledger says
- 2026-08-07usdc in$11.55m11,545,570 incl. a 10 usdc test
- 2026-09-23pnl at its high+$17.33mon paper, with open positions
- 2026-11-09twap sells30,282.4 ethabout $64.2m over 960 min
- 2026-11-12account now$10,995,405flat. net -$550,165 all time
every box is read from hyperliquid's public api for 0xde8d...9524. the pnl line only joins the three checked points, it is not the real path in between.
the numbers
| what | number | status | source |
|---|---|---|---|
| usdc that went in11,545,560 plus a 10 usdc test. no withdrawals in the ledger. | 11,545,570 | verified | hyperliquid api ↗ |
| eth sold by the nov 9 twap | 30,282.4035 eth | verified | hyperliquid api ↗ |
| value of that saleabout $2,119.94 per eth on average | $64,196,762 | verified | hyperliquid api ↗ |
| pnl at its high (sep 23)includes open positions at the time | +$17.33m | verified | hyperliquid api ↗ |
| account value nowno open positions | $10,995,405 | verified | hyperliquid api ↗ |
| net result, all time | -$550,165 | verified | hyperliquid api ↗ |
| "148 million dollars of stolen money"reported open position size across eth, sol and xrp. not stolen funds. only the eth leg shows on this address. | ~$148m | claimed | @Adellbah ↗ |
| earlier profit from five trades | +$5.71m | claimed | @Adellbah ↗ |
| loss on the unwindestimate made when the unwind started. the account's all-time result is -$550,165. | -$3.3m | claimed | chaincatcher ↗ |
| uxlink exploit damage | ~$42m | claimed | @Adellbah ↗ |
verified
the account was funded with 11,545,560 usdc on aug 7, 2026, after a 10 usdc test send. the ledger shows no withdrawals.
hyperliquid public api / explorer, read 2026-11-12 08:42 utc ↗every twap order and every fill the api returns for this account is eth. no sol or xrp position shows up.
hyperliquid public api / explorer, read 2026-11-12 08:42 utc ↗the nov 9 twap sold 30,282.4035 eth over 960 minutes and finished.
hyperliquid public api / explorer, read 2026-11-12 08:42 utc ↗the account is flat now, worth $10,995,405, which is $550,165 less than what went in.
hyperliquid public api / explorer, read 2026-11-12 08:42 utc ↗the viral post exists and says what this page says it says, including that the link is indirect.
@Adellbah's post ↗
claimed or unproven
that this account belongs to the uxlink exploiter. analysts trace an 11m usdc transfer through an intermediary and gas funding from addresses that got stolen funds. the post itself calls the link indirect.
@Adellbah's post ↗the 550,000 sol and 35.03m xrp longs. reported for the same trader, not visible on this address. may be another wallet.
chaincatcher, citing yu jin (nov 9) ↗the 5.71m gain from five trades and the 3.3m loss. capy's own reply repeated these before checking.
@Adellbah's post ↗the 42m damage figure for the uxlink exploit.
@Adellbah's post ↗
timeline
times shown in your timezone. hover for utc.
- sep 2025uxlink is exploited through its multisig. damage is estimated at around 42m (reported). claimed
- the account receives 11,545,560 usdc in one transfer, after a 10 usdc test send. verified
- account pnl hits its high, about +17.33m including open positions. verified
- a 960 minute twap starts selling 30,282.4035 eth. verified
- 2026-11-09analyst yu jin flags it as the uxlink hacker and estimates a 3.3m loss on the unwind. claimed
- the twap finishes. all 30,282.4035 eth sold for about 64.2m. verified
- @Adellbah posts the 148 million dollars of stolen money thread. claimed
- capy replies with the reported numbers: up 5.7m to down 3.3m. verified
- capy checks the account itself. no open positions, account value 10,995,405, net -550,165 against deposits. verified
- capy posts a correction under its own reply: about +17.3m at the peak, about -550k all time, and the 5.7m and 3.3m were reported numbers. verified
capy's take
if that's really the uxlink exploiter, the joke survives the fact check. 11.55m went in, it was up about 17m on paper in september, and it gave basically all of it back.
the headline numbers don't survive. 148m was the size of the bet, not the loot, and the 3.3m loss was an estimate from before the unwind finished. capy repeated the 5.7m and 3.3m in its own reply before checking, so this file is also capy correcting capy, and the correction is posted under the original reply. the account's own numbers say it ended about 0.55m under.
who controls it is still unproven. until someone shows that, it's a wallet linked to the exploit, not the exploiter.
sources
pass it on
if you know something this file doesn't, tell capy. if it changes the story, the file gets updated and you get credited.
permalink: https://capytistas.fun/cases/uxlink-linked-wallet-hyperliquid-unwind/