An attacker turned a tiny leftover token position into an $86,000 payday by exploiting UNCX Network’s shared vesting contract. The Oct. 14 breach exposed a bookkeeping flaw in a system designed to lock assets, with $3.25 million still inside.
Key Takeaways
- Security firm Blockaid identified an $86,000 exploit against UNCX’s shared Ethereum vesting pool on Oct. 14.
- Exvul security researchers traced the UNCX vulnerability to faulty share accounting that exposed deposits from 5 tokens.
- UNCX restricted new vesting positions as questions persisted over $3.25 million remaining in the pool.
How an $86,000 Exploit Turned a Token Lock Into a Liability
On Wednesday, blockchain security firm Blockaid sounded the alarm over an exploit targeting UNCX Network, formerly known as Unicrypt. Rather than stealing private keys or breaking into individual wallets, the attacker reportedly manipulated the contract’s own accounting machinery to withdraw tokens belonging to other users.
“The attacker created vesting positions in the shared token pool, released a large one, donated tokens in, then cancelled a topped-up vest so a tiny leftover vest could withdraw other users’ locked tokens,” Blockaid wrote on X.
The real eyebrow-raiser was what remained behind. Approximately $3.25 million was still sitting inside the affected Ethereum smart contract when Blockaid identified the attack as ongoing. Security researchers at Exvul subsequently provided a detailed explanation of the accounting flaw that made the theft possible.
What Is a Shared Token Vesting Pool?
To understand the caper, it helps to know what UNCX actually does. Operating since 2020, the platform provides cryptocurrency projects with tools to lock liquidity and distribute tokens according to predetermined schedules. Its services help founders, developers and investors demonstrate that certain assets cannot be sold before an agreed date.
Token vesting works much like a corporate stock compensation plan. Instead of receiving everything at once, recipients get their assets gradually, sometimes after an initial waiting period. The arrangement discourages early selling and helps keep participants committed to a project’s longer-term prospects.
A shared vesting pool takes that arrangement one step further. Rather than deploying a separate contract for every allocation, multiple decentralized finance (DeFi) projects place tokens inside common smart-contract infrastructure. Each position has its own recorded balance and release schedule, while the contract maintains the accounting for everyone.
It’s convenient, generally less expensive and easier to manage. But there’s a catch. When the shared bookkeeping goes haywire, funds belonging to unrelated projects can suddenly find themselves in the same predicament.
A Tiny Leftover Position Became the Attacker’s Golden Ticket
According to Exvul, the vulnerability centered on UNCX’s VestingManager contract and its handling of released and canceled token shares. These shares represent accounting claims against tokens held inside the contract.
The attacker first created new vesting positions, then released tokens from a substantial position. Additional tokens were subsequently deposited into the pool, and a previously funded position was canceled. That sequence produced the critical accounting discrepancy.
The security researchers explained that the contract’s release() function reduced the global _totalTokenShares figure without correspondingly removing released shares from the position’s _depositedShares record. When the position was later canceled, the contract deducted shares using the original recorded deposit, effectively counting the same reduction twice. A direct token donation further distorted the arithmetic.
The result was a tiny residual vesting position that could claim assets backing other users’ deposits. In ordinary language, the contract’s ledger no longer accurately reflected who was entitled to what. The attacker had found a way to make a nearly empty position behave as though it carried a much larger claim. No stolen private keys were required. The contract’s own mathematics did the heavy lifting.
Ten Tokens Taken as Researchers Trace the Money
Initially, the reported theft involved five distinct cryptocurrencies, EDGEN, ZC, PEPECOIN, LO0P and PAAL. A later update from UNCX shifted the count to ten tokens. That brings us to the real catch. The attacker wasn’t simply withdrawing money from an account they controlled. The flawed share calculations allegedly allowed one participant’s position to reach assets belonging to others. For a platform whose business revolves around preventing premature token withdrawals, that’s a particularly uncomfortable predicament.
UNCX Moves to Contain the Damage
UNCX acknowledged the incident on X and prevented new vesting positions from entering the affected contract while its team reviewed transactions and assessed the damage. The platform also established flat fees of 100 ETH, or the equivalent, across vesting contracts, creating another obstacle to ordinary activity while the investigation proceeded.
In its latest update at 7 p.m. Eastern time on Wednesday, UNCX confirmed the exploit affected ten tokens across four blockchains, including Ethereum, Base, BNB Chain and Robinhood Chain. The company raised flat fees above 1,000 ETH per lock, increased token fees to 5% and closed methods used to bypass those charges.
UNCX stressed that its liquidity lockers and legacy vesting contracts remain unaffected. Meanwhile, the company is working with law enforcement and SEAL 911 to investigate the breach.
Stolen Funds Remain Missing as Recovery Efforts Begin
UNCX said neither the original attacker nor copycats had returned any stolen funds. The platform is contacting affected projects, advising against trading impacted tokens in affected pools and preparing a comprehensive incident report with financial findings and a proposed recovery plan.
For now, the final losses remain uncertain, and the attackers are still holding the stolen assets.