A security exploit in UNCX Network's shared token-vesting infrastructure escalated from an initial $86,000 Ethereum drain into roughly $1.49 million in losses across four blockchains, according to blockchain security firm Blockaid.
On October 14, Blockaid reported an ongoing attack on UNCX's Ethereum vesting pool, with about $86,000 drained in a single transaction at 11:49 a.m. ET. The affected tokens included EDGEN, ZC, pepeCoin, LO0P and PAAL AI. By 12:26 p.m. ET, Blockaid warned that the exploit was continuing and linked a sender address to the suspected attacker.
On October 15, UNCX Network, formerly known as Unicrypt, confirmed that its Vesting V2 contracts had been exploited for approximately $1.49 million. Losses were distributed across BNB Smart Chain ($969,000), Ethereum ($242,000), Robinhood Chain ($169,000) and Base ($114,000) over 11 drain transactions, including activity from copycats and MEV bots. UNCX said it is coordinating with law enforcement and SEAL 911 on a recovery plan.
Security researchers at ExVul described the root cause as an accounting flaw in the VestingManager contract. The release() function reduced the global share total without removing released shares from a position's recorded deposit, allowing a later cancellation to deduct the same shares twice. By creating vesting positions, releasing a large position, donating tokens back, and canceling a topped-up position, the attacker produced a tiny leftover position able to withdraw tokens backing other users' deposits. No private keys were compromised; the contract's own bookkeeping enabled the drain.
UNCX stated the incident involves ten tokens: pepecoin, EDGEN, ZC, X, LO0P, and PAAL on Ethereum; IMO on Base; BTCLE on BNB Chain; and CASHCAT and RKST on Robinhood Chain. Liquidity lockers and legacy vesting contracts remain unaffected. To contain the exploit, UNCX raised flat fees above 1,000 ETH per new lock, removed paths that bypassed fees, and lifted token fees to the 5% contract maximum. About $3.25 million was still in the affected Ethereum contract when Blockaid identified the attack.
No funds have been returned by the original attacker or copycats, and UNCX advised against trading in affected pools until token teams issue guidance. A full incident report with technical findings and a proposed recovery plan is expected this week.
