Address linked to suspected UXLINK attacker still holds an E
On November 9, PANews and Odaily Planet Daily separately cited on-chain monitoring data to report two ETH long positions: a new address opened a position of 2,722.49 ETH, with a floating loss of $273,000; another address suspected of being related to the UXLINK attacker holds about 20,230 ETH longs on Hyperliquid, with a position value of about $42.65 million and a total loss of about $864,100.
Event timeline
- [11-09 02:21] A new address has been building a position of 2,722.49 ETH since yesterday, and now has a floating loss of $273,000 (PANews)
- [11-09 10:57] With a position value of about $42.65 million, an address suspected of being related to the UXLINK attacker still holds an ETH long position (Odaily Planet Daily)
Background and impact
At 02:21 on November 9, 2026, PANews, citing monitoring data from Ai Yi, reported that the new address 0x3ED…CB4BD had been building a position of 2,722.49 ETH since "yesterday," worth $6.105 million. Its most recent add-margin withdrawal occurred 4 hours ago, lowering the average withdrawal price to $2,242.75, and it now has a floating loss of $273,000. About 8 hours later, at 10:57 that day, Odaily Planet Daily, citing monitoring by Onchain Lens, reported that the address 0xde8d...9524, suspected of being related to the UXLINK attacker, still holds about 20,230 ETH longs on Hyperliquid, with a position value of about $42.65 million, using 15x leverage, and the position has been open for more than 3 months. The position has an unrealized loss of about $520,000, has paid about $1.47 million in funding fees, and has a total loss of about $864,100, with a liquidation price of $1,612.90.
The two pieces of information do not concern the same address. Source 1 describes a new address that has been building a position since "yesterday," along with the position size of 2,722.49 ETH and the add-margin action; Source 2 describes 0xde8d...9524, labeled as suspected of being related to the UXLINK attacker, with a position size of about 20,230 ETH, and includes fields such as the leverage multiple, how long the position has been open, funding fee expenditure and liquidation price. Source 1 does not mention leverage or liquidation price, and Source 2 does not mention when the address began building the position or its average price. The dimensions disclosed by the two do not overlap, and the material cannot be used to determine whether the two are related operations of the same entity.
Looking at the cost structure given by Source 2, the floating loss, funding fees and total loss are listed separately: the unrealized loss is about $520,000, funding fees paid are about $1.47 million, and the total loss is about $864,100. The funding fee item is higher than the unrealized floating loss itself, indicating that for this position, which has been open for more than 3 months and uses 15x leverage, the holding cost does not come only from price movements. Source 1 shows that after the new address lowered its average withdrawal price to $2,242.75 through add-margin, it remains in a floating loss. Both positions are ETH longs; the liquidation price of $1,612.90, the 15x leverage and the funding fee expenditure constitute observable points for follow-up tracking. It should be noted that all the above data come from third-party on-chain monitoring, and "suspected of being related to the UXLINK attacker" is a label applied by the monitoring party; no further confirmation information appears in the material. The addresses, sizes and metric definitions disclosed by the two sources differ, and they are presented here side by side without combination or inference. Readers who wish to check market prices themselves can view public ETH quotes through channels such as Huobi HTX registration and APP download, Zhima Gate.io registration and APP download, Bitget registration and APP download, Binance registration and APP download, and OKX registration and APP download, but the quote data themselves do not change the above on-chain facts.
FAQ
### Are these two ETH longs from the same address?
No. Source 1 is the new address 0x3ED…CB4BD, holding 2,722.49 ETH; Source 2 is 0xde8d...9524, holding about 20,230 ETH. The addresses are different, and the material does not state that any relationship exists.
### What does the liquidation price of $1,612.90 mean?
This is the liquidation price of the 15x leverage ETH long position on Hyperliquid held by the address described in Source 2. The material does not give the position of this price relative to the current market price, nor does it state whether the address will add margin.
### What information should be watched going forward?
You can track changes in the positions of the two addresses, whether they add to or reduce their positions, and subsequent changes in the liquidation price of $1,612.90 and the approximately $1.47 million in funding fees paid mentioned in Source 2; the labeling of address attribution still needs to be confirmed.