Wallet Tied to UXLINK Hacker Starts Closing $148 Million Hyperliquid Long, Expected Loss $3.3 Million

What changed since October

We covered this wallet on October 27, when reports showed the 30,282 ETH long sitting on $5.62 million of unrealized profit with ETH near $2,320. Thirteen days later the trade has turned. ETH was marked at $2,112.50 on Hyperliquid at 16:45 SGT, below the wallet's $2,134.45 entry, after a drop we wrote about this morning. Binance's ETH/USDT market showed a 24-hour low of $2,060 and a 5.5% fall when we checked at 16:47 SGT.

The tie to UXLINK is the analyst's tracing. PANews described the hacker as the person who took about $40 million from UXLINK last year and reported a direct funding overlap with known hacker addresses. No court finding or statement from Hyperliquid in what we read confirms who controls the wallet, so we keep the attribution with Yu Jin.

What the wallet shows

Odaily printed the address in shortened form, 0xde8d...9524. Hyperliquid's public leaderboard holds one address with that start and end: 0xde8d9e530b0528ffa7b1190f862536c055dd9524. Its ETH size matches the reports to the coin, and its deposits match the 11.54 million USDC reported in October: it received 11,545,560 USDC on August 7.

All figures below come from Hyperliquid's public info API at 16:45 SGT on November 9. They will have moved by the time you read this, because the sale is still running.

The schedule fits the reports. A 960-minute order that began at 13:36 SGT ends around 05:36 SGT on November 10, close to the "around 6 a.m." in Odaily's report. By our arithmetic the order was 19.7% through its time and 19.7% through its size at the moment we looked, so it was filling on pace.

How the position was built

The wallet's TWAP history shows it built in stages, all on ETH. On August 7 it bought 10,000 ETH for $19.13 million in 30 minutes, about $1,913 each. On August 8 and 9 a 36-hour order bought 25,000 ETH for $47.99 million, about $1,920 each. On August 19 it stopped one large buy after 5,206.61 ETH and another after 14,344.26 ETH, the second at about $2,028. It sold 5,150.8 ETH at $2,225 on August 20 for a closed profit of $864,566, then added again, with the last opening fill we can see at $2,451.90 on August 29. Those later purchases help explain why the entry sits at $2,134.45 even though the first coins cost near $1,900.

The $148 million adds up, the $3.3 million we could not rebuild

We priced the reported sizes at Hyperliquid's mark prices at 16:45 SGT:

That lands close to the reported $148 million, so the total is believable. The open question is where the SOL and XRP sit. Odaily names one address for all three legs. That address had an ETH position only on Hyperliquid's main perp market, and all 11 TWAP records in its history are for ETH. The other legs may live in a separate wallet that the analyst tracks. We did not find one, and neither report names one.

The expected loss is harder to check. On ETH alone, the closed loss of $156,320 plus the $533,602 unrealized loss comes to about $690,000 at the 16:45 SGT mark. Add the $1.47 million of funding and you reach about $2.16 million. The reports do not say whether their $3.3 million counts funding, or what the SOL and XRP entries were. So we cannot tell you how much of the figure belongs to each leg. Treat it as the analyst's estimate at the time of the post. The final number depends on the prices the rest of the order fills at.

Funding did more damage than the price

This is the part worth copying into your own notes. On the ETH leg, the price loss at 16:45 SGT was about $690,000, and funding was more than twice that.

Hyperliquid's documentation says funding is paid peer to peer between longs and shorts, and that its interest component works out to 0.00125% an hour, or 11.6% a year, paid to shorts. A long pays that baseline unless the perp trades below spot enough to flip the rate.

For this wallet, $1.47 million is about 2.3% of the $64.6 million entry value of the position (30,282.4 ETH × $2,134.45). Our arithmetic, one wallet. A reader holding the same trade at smaller size would pay at the same rate. On a $10,000 ETH long, 2.3% is $230. At 15x, that $10,000 position needs only about $667 of margin, so $230 would be about a third of the collateral. Funding is charged on position value, not on your margin, which is why it bites harder at higher multiples.

Funding had flipped by the time we checked. Hourly rates at 16:45 SGT were negative on all three coins, which under Hyperliquid's formula means shorts were paying longs:

Those rates are a single reading. You can compare them across venues on our funding rates page.

Could this sale move the market?

The ETH order on its own is small for Hyperliquid. It sells about 31.5 ETH a minute, or roughly $66,600 at the mark. The whole order is about 3.8% of one day's ETH volume there and 3.5% of open interest.

If the reported SOL and XRP legs are being closed the same way, they are a different size relative to their markets. Our arithmetic from the reported sizes:

So XRP is where a steady seller would be most visible, if that leg exists as reported and if it closes on the same schedule. We could verify neither. These shares do not tell you which way any price goes next. Liquidity also moves between venues, and Hyperliquid is only one of them.

How a TWAP works, and what to check

A TWAP splits a large order into smaller pieces at regular intervals. Hyperliquid's order types page says the intervals are at least 30 seconds and each suborder has a maximum slippage of 3%. The tool is open to anyone, and the point is to avoid moving the price with a single large fill.

If you hold ETH, SOL or XRP perps today, here is what this story changes:

1. Read your own funding line. Open your position history and add up funding paid since entry. Compare it with your unrealized profit. A position that looks flat on price can still be down once you do this.
2. Work out your liquidation distance. This wallet's liquidation price sat about 19% below the mark, at 15x and on cross margin with a large account behind it. Your distance at the same leverage depends on your own collateral, so read it from your own screen.
3. Do not treat the sale as a signal. A wallet tied to a hack closing a long says something about that wallet. Reports do not give its reason, and it could be raising cash, cutting a loss or moving the funds elsewhere.
4. Check the fills yourself. The address above is public, and anyone can look it up on a Hyperliquid explorer. For how the venue compares on fees and products, see our Hyperliquid page.

For the wider picture of who got flushed out in this drop, our liquidations page shows the recent long and short totals.

What we could not confirm

• Where the SOL and XRP positions sit, or whether their TWAP orders are running.
• How the $3.3 million loss estimate was built, and whether it includes funding.
• Who controls the wallet. The UXLINK link is an analyst's tracing as reported by PANews and Odaily.
• Where the money goes after the position closes. The wallet's account value was $5.15 million at 16:45 SGT, with a USDC balance on the spot side of about $10.77 million, and no withdrawal had been recorded in its ledger.

What to watch next: the wallet's position should reach zero near 05:36 SGT on November 10 if the order runs to the end. Any USDC leaving the account after that would be the next fact worth reporting.