UNCX vesting exploit: tokens worth $86,000 on paper sold for 14.9 ETH, and the gas came from Tornado Cash

UNCX (formerly UniCrypt) locks and vests tokens for other projects. Its VestingManager contract on Ethereum, 0xa98f06312b7614523d0f5e725e15fd20fb1b99f5, keeps the tokens of many vesting positions in one shared pool. Blockaid’s exploit detection flagged an attack on it on 14 October and put the loss at about $86,000. ExVul traced the cause to an accounting flaw: release() reduced the pool’s total shares but not the position’s own record, so a position could be counted twice and withdraw tokens that belonged to other users. UNCX said it stopped new positions from entering the contract.

Below is what the wallets show, read by us on 14 October 2026, a few hours after the attack.

The attacker’s wallet, 0x78C9B11853E4f183a34C63fFd1924d2319a2f5B3, received its first ether at 14:47 UTC and deployed the attack contract 0x6cEbDf095172B355121b93962017975C4601F26c three minutes later. At 15:49 one transaction to that contract did the whole job: it created the exploit contract 0xf6D072254Eb8A9B06e0bA21221b498332C1BC35E, borrowed each of the five tokens from Uniswap pools in flash swaps, opened and topped up positions in the vesting contract, released and cancelled them in the order that triggered the double count, and came out with more of each token than it had put in. Four more attempts between 15:58 and 16:25 failed.

Between 16:38 and 16:41 the attacker withdrew the proceeds from the exploit contract to its wallet: 55.6 million EDGEN, 40,155 PEPECOIN, 65,372 LO0P, 113,658 PAAL and 0.29 ETH.

The tokens went straight to market between 16:44 and 17:01 UTC: PEPECOIN through the LI.FI aggregator for 2.19 ETH, EDGEN through Uniswap for 8.57 ETH, LO0P through a UniswapX order for 3.46 ETH and PAAL through Uniswap for 0.41 ETH. With the 0.29 ETH from the contract, the attack produced 14.93 ETH, about $36,000.

The $84,000–86,000 in the reports values the tokens at their market price before the sale. These are small tokens with thin pools; selling them all at once moved the price. What the holders lost is the larger number. What the attacker gained is the smaller one.

9,055,847 ZC never left the exploit contract. The attacker withdrew the other four tokens but not this one, and it is still there, worth about $15,000 at the last price.

The attacker’s wallet was funded in three transfers, 0.1, 0.9 and 2.5 ETH, from 0x6D2Afff4Fc6FF46564467762c4aA35812680D606. That wallet’s only funding is 9.96 ETH withdrawn from Tornado Cash on 15 November 2025. At 17:09 UTC, an hour and twenty minutes after the attack, the attacker sent exactly 3.5 ETH back to it. The funding wallet still holds 7.46 ETH; the attacker’s wallet holds 13.72 ETH. Nothing has gone to a mixer or an exchange so far.

A wallet that lends gas from Tornado and is repaid to the wei after the job is the attacker’s own, or a partner’s. We filed it with the attack.

Within minutes of the sales, strangers sent the attacker’s wallet dust and zero-value transfers from addresses that start with 0x78c9 and 0x6D2A, like the attacker’s own wallet and its funder, and airdropped it a million units of an unknown token. Address-poisoning bots watch exploit wallets as closely as anyone’s.

We marked 4 addresses on Ethereum as part of the attack: the attacker’s wallet, the funding wallet, the attack contract and the exploit contract. None was marked before. We did not mark the vesting contract or the projects whose tokens were taken: they are the victims. We are watching the 13.72 ETH and will add to this page if they move.

To check an address yourself, use the address check.

It does not say who the attacker is, or that UNCX, the five projects, Uniswap, LI.FI or Tornado Cash did anything unlawful. The loss estimate is Blockaid’s and the root cause is ExVul’s. The realised 14.93 ETH, the stuck ZC, the Tornado-funded wallet and its repayment are ours, read on 14 October 2026.