UNCX Vesting Pool Hit by $86,000 Exploit, Blockaid Warns Attack Ongoing
What happened
An attacker drained about $86,000 from UNCX’s shared token‑vesting pool on Ethereum on Oct. 14, 2026. The exploit occurred in a single transaction that succeeded at 11:49 a.m. ET.
Five different tokens were taken from the pool: LayerEdge’s EDGEN, zipcoin’s ZC, pepeCoin, LO0P and PAAL AI. The affected contract still held about $3.25 million in assets at the time of the alert.
Blockchain security firm Blockaid identified the exploiter address as 0x78C9…f5B3 and warned that the attack was still ongoing at 12:26 p.m. ET.
Key details
- Loss amount: about $86,000.
- Transaction time: 11:49 a.m. ET on Oct. 14.
- Tokens stolen: EDGEN, ZC, pepeCoin, LO0P, PAAL AI.
- Contract balance after exploit: $3.25 million (Etherscan).
- Attacker address flagged by Blockaid: 0x78C9…f5B3.
- Blockaid alert: “Attack still ongoing” at 12:26 p.m. ET.
How the hack worked
The attacker used UNCX’s token‑vesting service, which lets users lock tokens for a set period before they are released. The exploiter created vesting positions in the shared pool, released a large position, and donated tokens into the pool. Then the attacker cancelled a position that had been topped up, leaving a tiny remaining vesting position that could withdraw tokens locked by other users. This method let the attacker move the five tokens out of the pool.
What remains unclear
Blockaid’s alert did not quantify the remaining exposure or confirm that the attack had been contained. It is unknown how much of the $3.25 million in the contract is still vulnerable, and the full impact beyond the reported $86,000 is not yet known.
Why this matters
The incident shows that token‑vesting protocols can be vulnerable to abuse of their release mechanics. An attacker can exploit the interaction between positions to access assets that belong to other users. The large amount still held in the contract highlights the ongoing risk for users of similar DeFi services.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.