PeckShield flagged a $45.3 million leveraged $ETH long on Hyperliquid on Nov. 9, describing the account as possibly linked to a UXLink exploiter through an intermediary wallet.

The security researcher’s alert put the position at about 21,550 $ETH, with an average entry price of $2,134.45 and 15x cross margin. At 5:33 a.m. ET, the account’s Hyperbot dashboard displayed a smaller long of about 20,919 $ETH, worth $44 million, with the same entry price and leverage setting.

PeckShield based its “exploiter-linked” description on an 11 million USDC transfer to the trading account from an intermediary address. That intermediary had interacted with an address labeled “UXLink Exploiter” on Aug. 28, according to the researcher. The reported connection is indirect: it does not by itself establish that the trader controls the exploiter wallet or that the entire transfer consisted of stolen funds.

Loading post from X…

View post on X

The Hyperbot snapshot showed an unrealized trading loss of roughly $652,000, with $ETH marked at $2,103.30 and an estimated liquidation price of $1,630.63. It separately displayed accumulated funding costs of about $1.47 million.

Hyperliquid’s own transaction explorer confirms that the account set its $ETH leverage to 15x using cross margin. Under the platform’s margin rules, cross-margin positions share collateral rather than ring-fencing it for an individual trade; liquidation depends on account value and maintenance-margin requirements, not the leverage setting alone.

UXLink, a web3 social platform, disclosed a breach involving its multisignature wallet on Sept. 22, 2025. The project said cryptocurrency had been illicitly transferred to centralized and decentralized exchanges and that it had reported the incident to authorities.

The Hyperliquid account also placed a scheduled $ETH sell order for 30,282.4035 $ETH over 960 minutes, according to the venue’s explorer. The record establishes the order’s placement, not its full execution.