UxlLink Exploiter Buys 6,001 ETH With $10.54M DAI, Uses Tornado Cash

A wallet linked to the UxlLink exploit used $10.54 million in DAI to purchase 6,001 ETH before routing a portion of the proceeds through Tornado Cash, the sanctioned cryptocurrency mixer, in a sequence that complicates any future recovery efforts.

What happened in the UxlLink exploiter’s ETH purchase

On-chain tracker OnchainLens flagged the transaction, identifying the wallet as exploit-linked. The address used $10.54 million DAI to acquire 6,001 ETH in what appears to be a deliberate conversion from stablecoins into a more liquid, mixable asset.

The purchase itself is notable because converting stablecoin proceeds into ETH is a common precursor to obfuscation. DAI, as an overcollateralized stablecoin, cannot be frozen by a centralized issuer the way USDT or USDC can, but ETH offers the additional advantage of compatibility with privacy-preserving protocols. For related coverage, see Fintech Revolution Summit Malaysia 2026 Opens Sponsorship, Speaking, and Exhibition Opportunities.

How the funds moved through Tornado Cash

After acquiring the ETH, the exploiter began moving funds through Tornado Cash. The mixer breaks the on-chain link between a deposit address and a withdrawal address, making it significantly harder for investigators to trace where the funds ultimately land. For related coverage, see US Bitcoin ETFs Post Eighth Consecutive Week of Net Outflows.

The sequence, converting DAI to ETH and then routing ETH through Tornado Cash, follows a well-documented laundering playbook. The stablecoin-to-ETH swap provides the denomination flexibility needed for Tornado Cash deposits, which accept fixed ETH amounts. For related coverage, see Morpho Association Raises $175M in Funding Round Led by Paradigm, a16z Crypto.

This escalation transforms the incident from a static exploit into an active laundering event. While the initial exploit wallet remains visible on Etherscan, the post-mixer outputs are far more difficult to attribute. For related coverage, see VALR to Launch Perpetuals Product Powered by Hyperliquid.

Why this matters for DeFi risk monitoring

Exploit-linked wallets that actively convert and mix stolen funds represent a higher-severity risk signal than dormant ones. The conversion into ETH, combined with mixer usage, suggests the attacker is prioritizing liquidity over holding, which typically precedes off-ramping attempts.

For protocols and investigators tracking exploit proceeds, the Tornado Cash step dramatically narrows the window for any coordinated freezing or recovery action. Once funds exit the mixer, attribution relies on probabilistic heuristics rather than deterministic tracing.

The incident also arrives amid broader scrutiny of large on-chain movements tied to exploits. Earlier this year, the Royal Government of Bhutan deposited 700 BTC to Binance, illustrating how sovereign and institutional wallet movements increasingly draw real-time on-chain attention from the same monitoring tools now tracking this exploit.

Risk teams monitoring DeFi exploits should note the active fund-movement status of this wallet. The combination of stablecoin liquidation, ETH acquisition, and mixer routing indicates the attacker is in an operational laundering phase rather than waiting out attention cycles.

Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.