A shared token vesting pool run by UNCX Network was exploited on Ethereum, with roughly $86,000 in tokens pulled out in a single transaction, according to security firm Blockaid.
The more uncomfortable number is the one left behind. The affected contract still held approximately $3.25 million in assets after the drain, and Blockaid flagged the attack as ongoing when it was detected.
How the vesting pool exploit worked
Blockaid reported the incident on October 14, 2026. The firm said one identified transaction took five different tokens out of the pool.
The method relied on bending the contract’s own vesting logic. Per Blockaid, the attacker opened fresh vesting positions, released and donated tokens in a deliberate sequence, then canceled those positions. That cancellation step is where other people’s money walked out the door. The process let the attacker withdraw assets that other users had locked in the same pool.
Blockaid made the exploiter addresses and a sample transaction public. That gives other security teams and onchain sleuths something concrete to trace, though publishing them does not, by itself, recover anything.
UNCX’s track record and what was hit
UNCX Network has operated since 2020 as a multi-chain platform for liquidity locking and token vesting. The protocol has reported over $164 million in total value locked since 2020 and more than 74,000 locks created.
The exploit targeted a shared vesting pool, not the individual locks or the core liquidity features UNCX is best known for. That distinction matters for users trying to work out whether they are exposed.
There was no immediate public response from the UNCX team at the time of Blockaid’s report.
What this means for token teams and DeFi users
The immediate concern is the approximately $3.25 million still sitting in the affected contract. If the attack path remained open, as Blockaid indicated it was at detection, the $86,000 drained so far may describe the opening act rather than the full bill.
Projects that use UNCX for vesting should check which contract their tokens sit in. Individual locks and liquidity locks were not the reported target, but teams will want confirmation rather than assumptions.
Five tokens were taken in the identified transaction. For smaller projects with thin liquidity, even a modest unscheduled release can weigh on price, though the effect would depend on each token’s market depth.
The broader lesson is structural. Shared contracts trade isolation for convenience, and this incident shows the cost of that trade when the internal bookkeeping can be gamed. Create, release, donate, cancel: none of those actions sounds hostile on its own, which is exactly what made the sequence dangerous.
The role of real-time monitoring also stands out. Blockaid caught the activity while it was still unfolding and published addresses and a transaction sample.
What to watch next: whether UNCX issues a statement explaining the flaw, whether the remaining balance in the contract is secured or migrated, and whether affected projects receive any form of reimbursement.
Disclosure: This article was edited by Estefano Gomez. For more information on how we create and review content, see our Editorial Policy.