Hacker Pulls $86,000 in Locked Tokens From a Shared Crypto Vault

A hacker drained about $86,000 from UNCX Networks shared token vesting pool on Ethereum on Wednesday, taking tokens other projects had locked away. Security firm Blockaid said the attack was still running. UNCX, formerly UniCrypt, sells crypto projects a way to lock up their own tokens so insiders cannot sell early. Its contracts hold about $179.7 million across blockchains, with $111.4 million on Ethereum. How Did the Attacker Withdraw Tokens Belonging to Others? Blockaid said the loss came through a single draining transaction. Many projects locked tokens sit together in the same pool. The attacker first opened several vesting positions there. A vesting position is a slot that holds tokens and releases them on a set schedule. Next, the attacker released one large position and sent extra tokens into the pool. They then cancelled a position that had been topped up. That move left behind a tiny leftover position. According to Blockaid, that small slot could then withdraw tokens owned by other users. UNCXs own guide describes vested tokens as time-locked in an audited contract. cannot be sent, sold, added to liquidity or staked, an excerpt in the guide reads. Blockaid named two exploiter wallets. Etherscan showed one of them holding about $5,874 across eight transactions. Why an $86,000 Loss Still Matters for Small Projects UNCX had not posted a public statement on the UNCX exploit by publication time. The platforms own token barely reacted. UNCX Network (UNCX) traded at $24.80, up 0.16% in 24 hours, according to BeInCrypto data. Its total market value stands near $905,000. UNCX Network (UNCX) Price Performance. Source: BeInCrypto Small losses can still sink a project. Decentralized exchange Full Sail wound down after a hack that cost roughly $91,000 in August. Older contract code has also been hit. Notional Finance lost $1.73 million through an integer overflow bug in legacy contracts in September. Token lockers exist so buyers can check that insiders cannot dump supply. The open questions are which projects lost tokens and whether UNCX can halt the pool before further withdrawals. Read the article at BeInCrypto