UNCX Hack Hits Shared Token Vault on Ethereum
Blockaid says the attack on a shared vesting pool also hit tokens from other projects. UNCX has paused its Ethereum services and started a broader audit.
Key Takeaways
- On Wednesday, a hacker drained about $86,000 from UNCX Network's shared token vesting pool on Ethereum.
- According to Blockaid, a single shared pool was used in an attack that affected tokens from multiple projects.
- UNCX launched a broader security audit and temporarily paused its vesting and liquidity-locking services on Ethereum.
A hacker took about $86,000 (€76,800) on Wednesday from the shared token vesting pool of UNCX Network on Ethereum. Tokens that other projects had locked there were also taken. Security firm Blockaid said the attack was still ongoing at the time of publication.
How the Attack Worked
UNCX, formerly UniCrypt, gives crypto projects a way to lock their own tokens so insiders cannot sell early. According to Blockaid, many projects were using one pool, which meant an attack on that setup could affect multiple parties.
The attacker first opened several vesting positions in the pool. Then one large position was unlocked and extra tokens were deposited into the pool. After that, a position that had been topped up earlier was canceled. That left a small leftover position, and according to Blockaid, it could then withdraw tokens from other users.
UNCX explains in its own documentation that vested tokens are locked in a controlled contract and cannot be sent, sold, added to liquidity, or staked.
Why This Matters for DeFi
UNCX had not made any public statement about the incident at the time of publication. The company, which has offered token locking and vesting services since 2020, currently manages more than $164 million (€146 million) in locked value across multiple blockchains, based on available data. On Ethereum, that total is about $111.4 million (€99.5 million).
The attack shows that even relatively small losses in DeFi can be sensitive when a shared setup affects multiple projects at once. That is why the sector is once again calling for extra security layers and stricter checks on smart contracts. According to available information, UNCX has now started a broader security audit of its smart contracts and temporarily paused its vesting and liquidity-locking services on Ethereum. That fits into a broader string of incidents where flaws in contract logic or key management directly cost money, such as the shift in crypto hacks toward keys and governance earlier this year.
Limited Market Reaction
UNCX's own token barely reacted. UNCX Network (UNCX) traded around $24.80 (€22), up 0.16% in 24 hours, with a total market value of nearly $905,000 (€808,400). That stands in contrast to the impact on smaller projects, where a relatively modest hack can be enough to seriously disrupt operations.
Blockaid named two wallets involved in the attack. Etherscan showed that one of those wallets held about $5,874 (€5,250), spread across eight transactions. The main open question now is which projects were hit exactly and whether UNCX can still stop any further withdrawals.
