UNCX Vesting V2 Exploit Drains $1.49M Across Four Chains

UNCX Network’s Vesting V2 contracts were exploited for roughly $1.49 million across four blockchains, blockchain security firm Blockaid reported on October 15, 2026, after an initial $86,000 drain on Ethereum grew more than 17-fold as copycat wallets and trading bots joined the attack. The vesting platform, formerly known as Unicrypt, disclosed the incident in an official statement and said it is coordinating with law enforcement and SEAL 911 toward a recovery plan.

UNCX lets crypto projects lock liquidity and schedule token vesting so team and investor allocations cannot be sold at once. Blockaid attributed the drain to an accounting flaw in the VestingManager contract, the shared pool that governs those schedules.

How the Accounting Flaw Was Exploited

The flaw involved how the contract tracked released and canceled vesting shares. Security researchers at ExVul, who examined the first Ethereum transaction, said the release() function reduced the global share total without removing released shares from a position’s recorded deposit, so a later cancellation deducted the same shares a second time.

By creating vesting positions, releasing a large one, donating tokens back, and then canceling a topped-up position, the attacker produced a tiny leftover position that could withdraw tokens backing other users’ deposits. No private keys were compromised; the contract’s own bookkeeping enabled the drain.

Scope and Containment Across Four Chains

Blockaid put losses at roughly $969,000 on $BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain, and $114,000 on Base, across 11 drain transactions that included copycats and MEV bots. UNCX said the incident involves 10 tokens: pepecoin, EDGEN, ZC, X, LO0P, and PAAL on Ethereum; IMO on Base; BTCLE on $BNB Chain; and CASHCAT and RKST on Robinhood Chain.

UNCX said its liquidity lockers and legacy vesting contracts remain unaffected. To contain the exploit it raised flat fees above 1,000 ETH per new lock, removed paths that bypassed fees, and lifted token fees to the 5% contract maximum. About $3.25 million was still in the affected Ethereum contract when Blockaid identified the attack.

What Happens Next

No funds have been returned by the original attacker or copycats on any chain, UNCX said, and it advised against trading in affected pools until the respective token teams issue guidance. A comprehensive incident report covering technical findings, financials, and a proposed recovery plan is expected this week.

The incident is the latest reminder that shared smart contracts, including token vesting infrastructure, can be drained without a wallet being breached, a risk examined in wider blockchain security coverage.