Attacker drains $86,000 from UNCX Network’s locked token vault on Ethereum

• UNCX’s contracts hold about $179.7 million in locked tokens across blockchains, with $111.4 million of that on Ethereum.
• Blockaid said the loss came through a single draining transaction and that the attack was ongoing at publication time.
• One of two exploiter wallets Blockaid identified held about $5,874 across eight transactions, according to Etherscan data.

• $86,000 drained from a pool holding $111.4M on Ethereum alone
• $179.7M UNCX’s total locked value across all blockchains
• $5,874 balance in one exploiter wallet across eight transactions

UNCX Network, formerly known as UniCrypt, sells crypto projects a mechanism to lock up their own tokens so insiders cannot sell before a public launch or vesting date. The product sits alongside its Liquidity Locker, and according to the company’s token vesting guide, it exists so projects can show “a commitment to hold the token” and build community trust. The guide describes the underlying contract as “fully audited,” a claim now in tension with Wednesday’s loss.

UNCX’s Guide Promises Tokens Cannot Be Moved

The documentation states plainly that vested tokens are time-locked in a smart contract and cannot be sent, sold, added to liquidity or staked until their schedule releases them. That design is the entire pitch to projects and the investors who check lockers before buying in: insiders are mechanically prevented from dumping supply early.

The exploit did not break that promise for any single project’s own lock. It broke the shared pool where many projects’ vesting positions sit side by side on the same contract, letting an outside position reach into tokens it never owned.

That distinction matters for any institutional allocator treating a vesting lock as a binary trust signal, since the risk here was not insider behavior but contract-level isolation between unrelated token issuers.

UNCX had not issued a public statement on the exploit by publication time, leaving open which specific projects had tokens pulled from the pool and whether the company can halt further withdrawals before the attack, which Blockaid described as still running, is contained.

Blockaid Traces the Loss to One Draining Transaction

Blockaid laid out the mechanics in a thread on X, detecting the exploit as it unfolded on the UNCX_token contract. The attacker first opened several vesting positions inside the shared pool, where a position is simply a slot that holds tokens and releases them on a schedule.

The attacker then released one large position while sending extra tokens into the pool. Cancelling a position that had just been topped up left behind a tiny leftover slot.

That small residual position, Blockaid said, could then withdraw tokens belonging to other users entirely, the step that converted a single transaction into an $86,000 loss spread across projects that had nothing to do with the attacker’s own deposits. Blockaid named two wallets tied to the exploit; one showed roughly $5,874 moved across eight separate transactions on Etherscan.

UNCX Token Trades Flat at $24.80 as Smaller Hacks Mount

UNCX Network’s own token barely reacted to the exploit of its flagship product. UNCX traded at $24.80, up 0.16% over 24 hours, against a total market value near $905,000, according to BeInCrypto data cited in its report on the drain.

An $86,000 loss is small next to major exchange hacks, but it lands in a pattern of mid-size breaches hitting smaller protocols hard. Decentralized exchange Full Sail wound down entirely after losing roughly $91,000 in August.

Notional Finance lost $1.73 million through an integer overflow bug in legacy contract code in September.

The CCS read. A token locker’s value to institutional buyers rests on contract isolation, not just audits or branding. If shared vesting pools can leak across unrelated projects, diligence teams need to confirm whether a lock sits in a dedicated contract or a pooled one before treating it as proof against insider selling.

UNCX has not named the affected projects or said whether it can freeze the shared pool before further withdrawals go through, and Blockaid’s thread indicated the exploit was still active as of Wednesday’s detection. The open questions now are which token issuers lost locked supply and whether UNCX follows Full Sail’s path or moves to patch the pool and compensate holders.