UNCX Network's Shared Token Vesting Pool Exploited for $86,000

A shared token vesting pool managed by UNCX Network was exploited on Ethereum, leading to the withdrawal of around $86,000 in tokens in a single transaction, as reported by security firm Blockaid. The incident was flagged on October 14, 2026, and it was noted that the affected contract still contained approximately $3.25 million in assets at the time of the attack.

The exploit involved the attacker manipulating the contract's vesting logic. They opened new vesting positions, released and donated tokens in a specific sequence, and then canceled those positions. This cancellation allowed the attacker to withdraw assets that belonged to other users who had locked their tokens in the same pool.

Blockaid has made the exploiter addresses and a sample transaction public, which could aid in tracing the activities of the attacker. However, this does not recover any stolen funds. UNCX Network, operational since 2020, has reported over $164 million in total value locked and more than 74,000 locks created. The exploit targeted a shared vesting pool rather than individual locks or core liquidity features, which is crucial for users assessing their exposure.

The ongoing nature of the attack raises concerns about the remaining $3.25 million in the affected contract. If the attack vector remains open, the initial loss of $86,000 may only represent the beginning of potential losses. Projects utilizing UNCX for token vesting are advised to verify the contracts their tokens are in, as individual locks and liquidity features were not the targets of the attack.

This incident highlights the risks associated with shared contracts, where convenience can lead to vulnerabilities. The sequence of actions taken by the attacker—creating, releasing, donating, and canceling—appeared benign but had severe consequences. The importance of real-time monitoring was underscored by Blockaid's ability to detect the exploit while it was still occurring.

Moving forward, stakeholders will be watching for a statement from UNCX regarding the exploit, the security of the remaining balance in the contract, and whether affected projects will receive any form of reimbursement.