Blockchain security firm Blockaid identified an $86,000 exploit targeting UNCX Network's shared Ethereum vesting pool on October 14. The attacker manipulated the contract's accounting system to withdraw tokens belonging to other users, rather than stealing private keys or breaking into individual wallets.
According to security researchers at Exvul, the vulnerability centered on UNCX's VestingManager contract and its handling of released and canceled token shares. The contract's release() function reduced a global shares figure without correspondingly removing released shares from individual position records. When a position was later canceled, the contract deducted shares using the original recorded deposit, effectively counting the same reduction twice. A direct token donation further distorted the accounting.
The result was a tiny residual vesting position that could claim assets backing other users' deposits. The attacker had found a way to make a nearly empty position behave as though it carried a much larger claim.
What UNCX Does
Operating since 2020, UNCX provides cryptocurrency projects with tools to lock liquidity and distribute tokens according to predetermined schedules. Token vesting works much like a corporate stock compensation plan, with recipients receiving assets gradually rather than all at once. A shared vesting pool allows multiple decentralized finance projects to place tokens inside common smart-contract infrastructure, with each position maintaining its own recorded balance and release schedule.
Scope of the Breach
The exploit initially involved five distinct cryptocurrencies: EDGEN, ZC, PEPECOIN, LO0P, and PAAL. A later update from UNCX indicated the attack affected ten tokens across four blockchains, including Ethereum, Base, BNB Chain, and Robinhood Chain.
Approximately $3.25 million was sitting inside the affected Ethereum smart contract when Blockaid identified the attack as ongoing. UNCX confirmed that neither the original attacker nor copycats had returned any stolen funds as of the company's latest update.
Response and Investigation
UNCX acknowledged the incident and prevented new vesting positions from entering the affected contract while its team reviewed transactions and assessed the damage. The platform established flat fees of 100 ETH across vesting contracts and later raised flat fees above 1,000 ETH per lock, increased token fees to 5%, and closed methods used to bypass those charges.
UNCX stressed that its liquidity lockers and legacy vesting contracts remain unaffected. The company is working with law enforcement and SEAL 911 to investigate the breach and is contacting affected projects while preparing a comprehensive incident report with financial findings and a proposed recovery plan.
