A hacker siphoned $86,000 from a shared token vesting pool on UNCX Network, stealing funds from other projects. The exploit is still ongoing.
On Wednesday, a hacker siphoned approximately $86,000 from UNCX Network's shared token vesting pool on Ethereum, stealing tokens that belonged to other projects. Security firm Blockaid reported that the exploit was still ongoing.
UNCX, previously known as UniCrypt, offers crypto projects a way to lock their tokens to prevent early sales by insiders. The platform's contracts hold about $179.7 million across blockchains, with $111.4 million on Ethereum.
According to Blockaid, the loss resulted from a single draining transaction. Many projects have their locked tokens stored together in a shared pool.
First, the attacker created multiple vesting positions. A vesting position is a slot that holds tokens and releases them on a predetermined schedule.
Subsequently, the attacker unlocked one large position and injected additional tokens into the pool. They then canceled a position that had been topped up.
This action left a very small leftover position. Blockaid stated that this small slot could then withdraw tokens belonging to other users.
UNCX's own documentation describes vested tokens as time-locked within an audited smart contract.
“cannot be sent, sold, added to liquidity or staked,” an excerpt in the guide reads.
Blockaid identified two exploiter wallet addresses. Etherscan data indicated that one of these wallets held approximately $5,874 across eight transactions.
🚨 Blockaid detected an ongoing exploit on @UNCX_token on ethereum.
— Blockaid (@blockaid_) October 14, 2026
~$86k drained from the shared vesting pool so far across 1 drain tx. Attack still ongoing. 🧵
As of the time of publication, UNCX had not issued any public statement regarding the exploit.
The platform's native token showed little reaction. UNCX Network (UNCX) was trading at $24.80, a 0.16% increase over 24 hours, according to BeInCrypto. Its total market capitalization is around $905,000.
Even small losses can be fatal for a project. For instance, decentralized exchange Full Sail wound down following a hack that cost roughly $91,000 in August.
Older contract code has also been exploited. Notional Finance suffered a $1.73 million loss due to an integer overflow bug in its legacy contracts in September.
Token lockers enable buyers to verify that insiders cannot dump supply. The remaining questions are which projects have lost tokens and whether UNCX can stop the pool before more withdrawals.
Share to
Disclaimer: this article comes from third-party media and is provided for reference only. It does not constitute investment advice. Crypto and other financial products carry significant price volatility risk, so please make your own decisions carefully.
Foundation blames compromised Cloudflare API keys for fake Passport recall emails sent from its own domains; customers ask how attackers knew their addresses.
Buterin supports Moonshot AI's removal of hacking skills from Kimi model for safety over user checks.
Bitcoin slipped under $80,000 as analyst Cowen reports two of nine bearish roadmap steps completed.
Retail Bitcoin deposits to Binance hit a six-month high and now run 2.8 times whale deposits, which fell 36% since late August.