PeckShield flagged a $45.3 million ETH long on Hyperliquid on Nov. 9. The security researcher said the account may be linked to a UXLink exploiter through an intermediary wallet. The alert put the position at about 21,550 ETH, with an average entry price of $2,134.45 and 15x cross margin. At 5:33 a.m. ET, the account’s Hyperbot dashboard showed a smaller long of about 20,919 ETH, worth $44 million, with the same entry price and margin setting.
The link is indirect. PeckShield based its exploiter-linked description on an 11 million USDC transfer to the trading account from an intermediary address. That intermediary had interacted with an address labeled UXLink Exploiter on Aug. 28, according to the researcher. The reported connection does not by itself establish that the trader controls the exploiter wallet or that the entire transfer consisted of stolen funds.
What the Position Shows
The Hyperbot snapshot showed an unrealized trading loss of roughly $652,000. ETH was marked at $2,103.30, with an estimated liquidation price of $1,630.63. It separately displayed accumulated funding costs of about $1.47 million.
Hyperliquid’s own transaction explorer confirms that the account set its ETH margin to 15x using cross margin. Under the platform’s margin rules, cross-margin positions share collateral rather than ring-fencing it for an individual trade. Liquidation depends on account value and maintenance-margin requirements, not the margin setting alone.
The Hyperliquid account also placed a scheduled ETH sell order for 30,282.4035 ETH over 960 minutes, according to the venue’s explorer. The record establishes the order’s placement, not its full execution.
UXLink Breach Background
UXLink, a web3 social platform, disclosed a breach involving its multisignature wallet on Sept. 22, 2025. The project said cryptocurrency had been illicitly transferred to centralized and decentralized exchanges. It also said it had reported the incident to authorities.
For now, the Hyperliquid position is the clearest on-chain signal. The UXLink connection remains a research lead, not a court finding. PeckShield’s alert may draw attention to how large margin trades can be traced, but it does not settle who controls the funds behind the account.
