An attacker drained approximately $86,000 from the UNCX vesting pool on Ethereum by exploiting a logic flaw in position management. Security firm Blockaid reported that cancelling a topped-up position allowed a minimal remaining vesting position to withdraw tokens locked by other users. The vulnerability enabled unauthorized access to pooled funds through the manipulation of vesting position states. The exploit highlights critical risks in smart contract position handling mechanisms within DeFi vesting infrastructure.