“The team’s tokens are locked” is often used as reassurance, but this week’s UNCX incident is a reminder: the tokens may be locked, but the risks in the contract itself are not.
10/15 00:26 (UTC+8) / 10/14 16:26 UTC: Blockaid issued an alert that UNCX, which provides token-locking and vesting services for projects, had suffered an attack on its Vesting V2 contract. By the afternoon of 10/15, a total of about $1.49 million had been taken across four chains: about $969,000 from BNB Chain, $242,000 from Ethereum, $169,000 from Robinhood Chain, and $114,000 from Base. Among the 11 withdrawal transactions were copycat wallets and MEV bots.
How it happened (ExVul’s analysis): Tokens from many projects were held in the same shared pool, with the contract accounting for them in “shares.” After claiming tokens and then canceling a position, the shares that had already been claimed were deducted a second time. The attacker then transferred tokens directly into the pool to amplify the discrepancy, allowing an almost-empty position to claim tokens locked by other projects. The entire process required no private keys to be stolen.
What this means for ordinary token holders:
1. Locking tokens only ensures that the team cannot sell them early; it does not guarantee that the contract is bug-free. If a shared pool is compromised, projects with no connection to the attacker can also get caught up in the fallout.
2. When you see proof that tokens are locked, ask one more question: Which contract and version are they locked in, and has it been audited?
3. The stolen tokens may be sold into the same pool, so holders are the first to suffer.
UNCX said that LP locks and the old version of vesting were unaffected. This incident involved 10 tokens: pepecoin, EDGEN, ZC, X, LO0P, and PAAL (Ethereum); IMO (Base); BTCLE (BNB Chain); and CASHCAT and RKST (Robinhood Chain). The official recommendation is to avoid trading these tokens in the affected pools for now, until each project team issues an update. The funds taken from Base have been returned in full by a white hat; UNCX has offered a 10% bounty for the other addresses, with a 48-hour deadline.
Safety reminder: Follow only UNCX’s official account and official announcements from the projects whose tokens you hold. Treat any private messages or links claiming “victim compensation” or asking you to “connect your wallet to claim funds” as scams.
Sources: Blockaid, ExVul, UNCX’s official X account (10/14–10/15) | Not investment advice
10/15 00:26 (UTC+8) / 10/14 16:26 UTC: Blockaid issued an alert that UNCX, which provides token-locking and vesting services for projects, had suffered an attack on its Vesting V2 contract. By the afternoon of 10/15, a total of about $1.49 million had been taken across four chains: about $969,000 from BNB Chain, $242,000 from Ethereum, $169,000 from Robinhood Chain, and $114,000 from Base. Among the 11 withdrawal transactions were copycat wallets and MEV bots.
How it happened (ExVul’s analysis): Tokens from many projects were held in the same shared pool, with the contract accounting for them in “shares.” After claiming tokens and then canceling a position, the shares that had already been claimed were deducted a second time. The attacker then transferred tokens directly into the pool to amplify the discrepancy, allowing an almost-empty position to claim tokens locked by other projects. The entire process required no private keys to be stolen.
What this means for ordinary token holders:
1. Locking tokens only ensures that the team cannot sell them early; it does not guarantee that the contract is bug-free. If a shared pool is compromised, projects with no connection to the attacker can also get caught up in the fallout.
2. When you see proof that tokens are locked, ask one more question: Which contract and version are they locked in, and has it been audited?
3. The stolen tokens may be sold into the same pool, so holders are the first to suffer.
UNCX said that LP locks and the old version of vesting were unaffected. This incident involved 10 tokens: pepecoin, EDGEN, ZC, X, LO0P, and PAAL (Ethereum); IMO (Base); BTCLE (BNB Chain); and CASHCAT and RKST (Robinhood Chain). The official recommendation is to avoid trading these tokens in the affected pools for now, until each project team issues an update. The funds taken from Base have been returned in full by a white hat; UNCX has offered a 10% bounty for the other addresses, with a 48-hour deadline.
Safety reminder: Follow only UNCX’s official account and official announcements from the projects whose tokens you hold. Treat any private messages or links claiming “victim compensation” or asking you to “connect your wallet to claim funds” as scams.
Sources: Blockaid, ExVul, UNCX’s official X account (10/14–10/15) | Not investment advice