A hacker drained approximately $86,000 from UNCX Network's shared token vesting pool on Ethereum on Wednesday, targeting tokens that other projects had locked away. Security firm Blockaid confirmed the attack was still running at the time of reporting.
UNCX, formerly UniCrypt, provides cryptocurrency projects with a service to lock up their tokens, preventing early sales by insiders. The platform currently holds about $179.7 million across multiple blockchains, with $111.4 million on Ethereum.
How the Attack Worked
According to Blockaid, the breach occurred through a single draining transaction that exploited the structure of UNCX's shared pool, where many projects' locked tokens are held together.
The attacker created several vesting positions in the pool. They then released one large position and sent additional tokens into the pool before cancelling a position that had been topped up. This process left behind a small leftover position that could subsequently withdraw tokens owned by other users.
Blockaid identified two exploiter wallets involved in the attack, with one holding approximately $5,874 across eight transactions.
Market Impact and Industry Context
UNCX Network had not issued a public statement regarding the exploit by the time of reporting. The platform's native token, UNCX, showed minimal market reaction, trading at $24.80 and up 0.16% over 24 hours, with a total market value near $905,000.
While $86,000 may seem modest compared to some major exploits, such losses can prove fatal to smaller projects. Decentralized exchange Full Sail shut down following a hack that cost approximately $91,000 in August. Similarly, Notional Finance lost $1.73 million through an integer overflow bug in legacy contracts in September.
Token lockers serve an important function in the cryptocurrency ecosystem, allowing investors to verify that project insiders cannot immediately dump token supply onto the market. The immediate questions facing the community are which projects were affected by the breach and whether UNCX can halt the vulnerable pool before additional withdrawals occur.
