An investor operating on decentralized derivatives platform Hyperliquid and previously linked to the UXLINK exploit has begun unwinding open positions totaling $148 million after incurring heavy losses. This investor initiated a 16-hour TWAP (Time-Weighted Average Price) algorithm on November 9 to systematically reduce exposure, with the program scheduled to conclude at 06:00 GMT on November 10.
Losses escalate as positions are liquidated
Identified in the past as one of the most profitable addresses on Hyperliquid, this wallet reversed direction amid the recent market downturn. The investor’s net loss currently reaches $3.3 million. The ongoing unwinding process is reportedly contributing to increased short-term selling pressure on Ethereum, Solana, and XRP.
The portfolio’s Ethereum long position contains 30,282 ETH, valued at around $55.46 million. This position faces liquidation if the ETH price drops to $1,740.
On Solana, the investor holds a 550,000 SOL long position, opened with 10x leverage. Total liquidation will occur if Solana’s price falls to $65.6. The portfolio also includes 35.03 million XRP, worth approximately $35 million, with a liquidation threshold set at $0.94 per XRP.
The 16-hour TWAP sales program, launched on November 9, aims to gradually close all $148 million in open positions.
| Asset | Position Size | Current Value | Liquidation Price |
|---|---|---|---|
| Ethereum (ETH) | 30,282 ETH | $55.46 million | $1,740 |
| Solana (SOL) | 550,000 SOL (10x leverage) | — | $65.6 |
| XRP | 35.03 million XRP | $35 million | $0.94 |
Renewed scrutiny on UXLINK connection
In September 2025, UXLINK, a crypto social network featuring Telegram integration, suffered a security breach. Attackers exploited vulnerabilities in its multi-signature infrastructure, draining treasury assets and minting new tokens. The total damage, including market depreciation after the attack, was estimated at $42 million.
Mini dictionary: TWAP is a trading strategy that executes large orders in small amounts over a specified timeframe to minimize market impact. Multi-signature (multi-sig) infrastructure requires several approvals before allowing transactions from a wallet, enhancing security.
In August 2026, an anonymous investor deposited 11.54 million USDC into Hyperliquid. Blockchain security firm EmberCN claimed that the wallet used for covering gas fees received ETH from addresses linked to previously stolen UXLINK funds. This finding revived concerns about possible connections between this investor and the prior exploit.
EmberCN alleges that ETH transferred to the investor’s gas fee wallet originated from addresses connected to stolen UXLINK funds.
From record profits to liquidation risks
Previously, the investor recorded profits on five consecutive trades, with total gains reaching $5.71 million. At the end of October, unrealized profit on the Ethereum position alone stood at $5.6 million.
The recent market correction erased these accumulated gains, leaving much of the portfolio at risk of liquidation. Ongoing position reductions could add additional pressure, especially on highly leveraged trades.
