An $86,000 Exploit Rocks a Crypto Pool Built to Lock Tokens

An attacker turned a tiny leftover token position into an $86,000 payday by exploiting UNCX Network’s shared vesting contract. The Oct. 14 breach exposed a bookkeeping flaw in a system designed to lock assets, with $3.25 million still inside. On Wednesday, blockchain security firm Blockaid sounded the alarm over an exploit targeting UNCX Network, formerly known as Unicrypt. Rather than stealing private keys or breaking into individual wallets, the attacker reportedly manipulated the contract’s own accounting machinery to withdraw tokens belonging to other users. “The attacker created vesting positions in the shared token pool, released a large one, donated tokens in, then cancelled a topped-up vest so a tiny leftover vest could withdraw other users’ locked tokens,” Blockaid wrote on X. The real eyebrow-raiser was what remained behind.