UNCX Vesting Pool Exploit: How $86K Slipped Out of “Locked” Tokens

Home » UNCX Vesting Pool Exploit: How $86K Slipped Out of “Locked” Tokens

October 15, 2026 0

Editor’s Update: October 16, 2026. The loss is much larger than the $86,000 first reported. Blockaid’s later tally, relayed by Crypto Times, is about $1.49 million across four chains (BNB Smart Chain about $969,000, Ethereum about $242,000, Robinhood Chain about $169,000, Base about $114,000) in 11 drain transactions, some by copycat addresses and MEV bots. Ten tokens are affected: pepecoin, EDGEN, ZC, X, LO0P and PAAL on Ethereum, IMO on Base, BTCLE on BNB Chain, and CASHCAT and RKST on Robinhood Chain. UNCX has confirmed the incident is limited to Vesting V2, says its liquidity-pool lockers and legacy vesting contracts are unaffected, raised the fixed vesting fee above 1,000 ETH and the token fee to the 5% maximum, and is working with law enforcement and SEAL 911. It has advised holders to avoid trading in affected liquidity pools until each project gives guidance, and promised a full incident report and recovery plan. As of the latest reports, no funds had been returned and UNCX hadn’t published a final loss figure. A 10% bounty offer for returning the assets within 48 hours (18.207 ETH and 510,727 USDT) has been reported by KuCoin News citing ME News and Defimon Alerts, but we couldn’t confirm it from UNCX directly, so treat it as single-sourced. The earlier figures below describe the first Ethereum transaction only. Sources: Crypto Times, Blockfence, TokenPost, KuCoin News.

Quick answer: On October 14, 2026, an attacker drained about $86,000 in five ERC-20 tokens from a shared token-vesting contract run by UNCX Network on Ethereum, according to security firm Blockaid. The attacker didn’t steal a private key. They exploited an accounting flaw: by opening, releasing, topping up and cancelling vesting positions in a particular order, they got the contract to hand over tokens that other projects had locked. Blockaid described the attack as ongoing when it first flagged it, and UNCX says it has paused new vesting positions while it reviews what happened. The dollar figure is small. What the bug says about “locked” tokens isn’t.

What happened on October 14

Blockaid flagged the exploit on X on Wednesday, October 14. Crypto Briefing and The Defiant both reported it that afternoon, and KuCoin’s republished CoinEdition piece puts the draining transaction at around 11:49 a.m. Eastern, with Blockaid warning at 12:26 p.m. that it was continuing.

The target was UNCX’s shared vesting pool on Ethereum, the contract where many different projects park team and investor tokens on a schedule. Blockaid’s headline number is about $86,000, taken in a single identified transaction. ExVul, another security outfit, put the haul at roughly $87,700 at spot prices from that block and estimated the attacker’s profit after gas at about $84,200. Those are estimates, not confirmed realized proceeds.

ExVul lists the tokens involved as EDGEN, ZC, PEPECOIN, LO0P and PAAL. Both Blockaid and ExVul published the attacker’s wallet addresses, so the trail is public. Nobody has put a name to it.

One caution on scale. The Defiant and Crypto Briefing say the affected contract still held about $3.25 million in assets after the drain. That’s what sat in the contract, not what was provably at risk, and the outlets describe remaining exposure as unconfirmed. Total losses and the number of affected projects aren’t known yet.

What UNCX actually does

UNCX Network, formerly UniCrypt, has been around since 2020. Projects use it to lock liquidity-pool tokens and to vest team or investor allocations, so that buyers can see on-chain that a team can’t dump its bag tomorrow. Crypto Briefing reports it has handled more than 74,000 locks and over $164 million in value locked since launch. BeInCrypto cites a different figure, about $179.7 million across chains with $111.4 million on Ethereum. Different outlets, different snapshots, so treat both as ballpark.

That’s the business, and it explains why this exploit matters beyond its size. A vesting lock is a promise made to the market: these tokens can’t move until the schedule says so. If the contract holding the promise can be tricked, the promise is worth less. If you want the basics on why those schedules move prices in the first place, our guide to token vesting and unlock schedules covers it.

How the exploit worked

There are two accounts of the mechanism, and they fit together.

Blockaid’s version: the attacker created several vesting positions, released one large position, then added tokens to the pool. They then cancelled a topped-up position. That left a tiny residual position which could withdraw tokens belonging to other users. Everything happened in a deliberate sequence.

ExVul’s suspected root cause is more specific, and it’s a hypothesis, not a confirmed post-mortem. ExVul points to a flaw in UNCX’s VestingManager contract. When release() ran, it reduced the pool’s global share total, but the released shares stayed in the position’s own deposited-share record. When the position was later cancelled, the contract subtracted those same shares from the global total a second time. A direct token donation amplified the distortion.

Here’s the plain-English version. Picture a shared safe with a ledger that says “total owed: 100.” You withdraw your 40, and the clerk knocks the total down to 60 but forgets to update your personal slip. When you later close your account, the clerk subtracts your 40 again, so the total reads 20 while the safe still holds real money from other customers. Now each remaining share looks worth far more than it should, and a tiny leftover claim can pull out someone else’s tokens. The attacker’s donation step just made the arithmetic worse.

It’s the sort of bug that code reviews miss because every individual function looks sensible. The problem only shows when you call them in the wrong order. That’s also why the attacker could run it from scratch with nothing but gas money.

ExVul said the vulnerable code path was still active at the latest block it checked, though it couldn’t establish the contract’s current status. That’s why the “ongoing” label from Blockaid mattered.

UNCX’s response so far

Per Crypto Times, UNCX paused new vesting positions from entering the contract while it reviews transactions and next steps for affected users. It also set flat fees on all vesting contracts to 100 ETH or equivalent, which effectively blocks new activity without removing the contracts. The team said positions in its other contracts, and the liquidity-provider positions locked through its service, were safe, calling the incident isolated. It promised a consolidated update.

Those statements are UNCX’s own claims, and the Crypto Times report notes no independent review has confirmed them. Crypto Briefing also noted that the exploit hit the shared vesting pool rather than individual locks or the core liquidity-locking product, which is consistent with UNCX’s framing but isn’t the same as an audit sign-off. At the time of writing, we found no published post-mortem.

There’s one more loose end. An X user named 0xBudderr claimed that FreeSpeech.FTW was affected and reported about $23,000 in token sales. Crypto Times flags that this doesn’t establish the project’s total exposure. We’d treat it as an unverified lead.

Why a small hack deserves attention

Eighty-six thousand dollars is a rounding error next to this year’s headline incidents. The Bitget breach ran to hundreds of millions, and the Base vault whitelist hack took about $6 million. So why spend time on this one?

Three reasons.

It’s a logic bug, not a stolen key. Several of the big 2026 losses involved compromised keys, social engineering or admin access. This one is pure accounting, the kind of bug that can sit in audited code for years.
It hits shared infrastructure. A single pooled contract holding many projects’ locks means one flaw can touch many unrelated tokens at once. That’s the same concentration risk we describe in our piece on DeFi exploits in 2026.
It targets the trust signal itself. Teams lock tokens to reassure holders. When the lock leaks, the reassurance goes with it, often for small-cap tokens that were already thinly traded.

BeInCrypto also lists two other recent DeFi incidents for context: Full Sail lost about $91,000 in August, and Notional Finance lost roughly $1.73 million in September through an integer overflow in legacy contracts. Crypto Briefing’s author suggested the $86,000 might be an “opening act,” but that’s their interpretation, not a confirmed fact. We don’t know yet whether more funds are at risk.

A scenario: when “locked” tokens aren’t

Imagine you hold a small-cap token whose team announced a two-year vest, locked through a well-known service. That lock is the reason you felt comfortable buying. Then a security account posts that the vesting contract is being drained. You check the token’s chart, then the team’s Telegram, then the contract on Etherscan. Nothing is happening in the chat. The price is still flat.

What do you do? Honestly, there isn’t much you can do in the first hour, and that’s the point. The useful work happens before: knowing which contract holds the team’s allocation, whether it’s a shared pool or a dedicated lock, and whether your token’s team has a plan for a bug like this. After the fact, the useful questions are whether tokens were pulled from your project’s lock, and whether the team confirms it.

What holders and projects can do

If you hold tokens that use vesting or liquidity locks, a few practical checks:

Find the lock. Most projects publish a lock link. See whether it’s a shared pool contract or an individual one, and whether it holds roughly what the team said it would.
Watch official channels. UNCX promised a consolidated update. Project teams affected by this should confirm whether their tokens were among the five, or others.
Be wary of “recovery” messages. After any exploit, scam accounts pose as support teams. Never connect a wallet or sign anything from a link in a DM.
Don’t confuse this with your own wallet. This was a contract-level bug. Holders who hadn’t locked anything through UNCX aren’t directly exposed.

For projects, the lesson is less comfortable. A lock is only as good as the contract behind it, and “audited” is a statement about a point in time. Teams that can afford it should consider holding allocations in contracts they control, with multi-sig governance, rather than assuming a shared pool is neutral ground. Smaller teams don’t always have that option, which is why shared services exist.

It’s also worth a thought on what this does to token unlock analysis. Unlock calendars, like the one in our October 2026 token unlocks guide, assume locked tokens stay locked until their date. That assumption holds only if the lock contract works. It usually does. This week showed what happens when it doesn’t.

What we don’t know yet

A fair list of open questions:

Whether the root cause is the release() and cancel double-subtraction ExVul suspects, or something else. UNCX hasn’t published a technical post-mortem.
How many projects and users had tokens in the affected pool, and how much more could be taken.
Whether any funds can be recovered. Small exploits sometimes end with negotiated returns, but there’s no sign of that here.
Whether the code path has been fully closed, or only new deposits blocked.

We’ll update this piece when UNCX publishes its consolidated update.

FAQ

What happened in the UNCX exploit?

On October 14, 2026, an attacker drained roughly $86,000 in five tokens from UNCX Network’s shared token-vesting pool on Ethereum, according to Blockaid. The attacker manipulated the pool’s accounting through a sequence of vesting-position actions.

Which tokens were affected?

ExVul lists EDGEN, ZC, PEPECOIN, LO0P and PAAL for the identified transaction. Other tokens may be affected, and total losses are unconfirmed.

Is my liquidity lock on UNCX safe?

UNCX says positions in its other contracts and liquidity-provider positions locked through its service are safe, and calls the incident isolated. That’s the company’s own claim and hasn’t been independently verified.

Was this a hack of UNCX’s keys?

Nothing reported so far points to a key compromise. Blockaid and ExVul both describe a contract logic flaw exploited through normal function calls.

How much money is at risk?

About $86,000 has been taken. The affected contract still held around $3.25 million in assets, according to The Defiant and Crypto Briefing, but how much of that was vulnerable is unconfirmed.

Should I sell tokens that use UNCX vesting?

That’s your call, and we can’t make it for you. Check whether your token’s team has confirmed its locks are intact before drawing conclusions.

Key takeaways

An attacker took about $86,000 in five tokens from UNCX’s shared Ethereum vesting pool on October 14, 2026, per Blockaid.
The suspected cause is an accounting flaw where released shares were subtracted from the pool total twice. ExVul’s explanation is a hypothesis until UNCX publishes a post-mortem.
UNCX paused new vesting positions and says its other lock products are safe. Those are unverified company statements.
The dollar loss is small, but the incident shows that a token lock is only as reliable as the contract behind it.
Details such as the total exposure and affected projects are still unconfirmed, so watch for UNCX’s promised update.

This article is educational and is not financial advice. Details of fast-moving security incidents can change after publication. Do your own research (DYOR) before making any decision.

Want more on how DeFi incidents unfold and what they mean for holders? Browse our related coverage on yield farming risks and the Base vault hack, and subscribe so you don’t miss the next update.

Sources & references

Blockchain News

Sidechains vs. Layer-2s: What’s Actually the Difference?

October 26, 2026