UNCX Smart Token Vesting shared pool on Ethereum drained of about $86k in five ERC-20 tokens

Summary

On 14 October 2026 Blockaid detected an ongoing exploit of UNCX's shared token-vesting pool on Ethereum, reporting about $86k drained in one drain transaction and stating the attack was still ongoing at the time. ExVul independently reported that UNCX Smart Token Vesting was drained of five ERC-20 tokens worth about $87.7k at parent-block spot prices. UNCX acknowledged the incident and paused new vesting positions on the contract.

Affected

• UNCX Smart Token Vesting contract on Ethereum (shared vesting pool)
• Tokens drained per ExVul: EDGEN, ZC, PEPECOIN, LO0P, PAAL
• No fix announced at time of publication; UNCX is reviewing the transactions

Impact

Per ExVul, the exploit contract retained about $85.6k in the five tokens; after 0.5624 ETH in fees/gas the estimated mark-to-market profit was about $84.2k. Blockaid said the attack was ongoing when it raised its alert. Media reports cite about $3.25M in token holdings remaining in the UNCX V2 vesting contract; how much of that is exposed has not been confirmed. Root cause has not been published. UNCX later stated that locked positions are safe and described the incident as a one-off; no independent confirmation is available yet.

Recommended actions

• Do not create new vesting positions on the affected UNCX vesting contract until UNCX publishes a post-mortem.
• Projects whose tokens are held in the UNCX shared vesting pool should check their balances and follow UNCX's official updates.
• Block or monitor the attacker and exploit-contract addresses listed in the indicators.

Source & attribution

This 0xCERT advisory summarises alerts by Blockaid (https://x.com/blockaid_/status/2110406902752387455) and ExVul (https://x.com/exvulsec/status/2110408967822381342), and UNCX's own statement (https://x.com/UNCX_token/status/2110413504008089965). Indicators are as attributed by ExVul and Blockaid, as reported by The Crypto Times (https://www.cryptotimes.io/2026/10/15/blockaid-reports-86k-drained-in-uncx-vesting-pool-exploit/). Details may change; refer to the original sources for the authoritative record.