Skip to content
THREATWIRE

2026-10-14 · record inc_0013 · updated 2026-10-19

UNCX Vesting V2: share records and token balance made to disagree

A sequence of public calls corrupted share accounting and let attackers withdraw other projects' tokens on four chains.

UNCX NetworkEthereumBNB ChainBaseRobinhood ChainComponent: Smart Token Vesting V2 (VestingManager)

Event: Confirmed on-chainRoot cause: Official statementLoss: Official statement

Current status

Under review with counsel.

Timeline

  1. 2026-10-14 15:49:59 UTCFirst Ethereum drain transaction confirmed.
  2. 2026-10-15UNCX incident report published.
  3. 2026-10-16 14:02 UTCWhitehat return of token X on Ethereum.

Root cause

Per UNCX, release() removed shares from the global total while the position's deposited-share record stayed, and cancel() reused the old record, leaving the total too low.

Basis: official post-mortem · verified by us against that source

Classes: Accounting and share-price errors, Flash-loan amplification

Impact: loss and recovery

Ten tokens on four chains. LP lockers and legacy vesting not affected, per UNCX.

Reported loss

$808K

USD basis: UNCX realised and routed economic value. Earlier tallies reached about $1.49M; the first Ethereum transaction was about $86K to $88K.

Recovered or returned

Partial

Whitehat returns of 82,143,476 units of token X and 23.87 ETH are listed by UNCX with no dollar value.

Loss and recovery are separate figures. They are never netted, and amounts in different currencies are never added together.

Addresses and transactions

Contracts and wallets

  • 0xa98f06…1b99f5contractEtherscan ↗

    Vesting V2 manager on Ethereum (affected)

    Ethereum · victim · Confirmed on-chain · contract code present at the address (read-only)

Transactions

  • 0x352065…23823dtxEtherscan ↗

    first drain (Ethereum) · block 26,191,745 · 2026-10-14 15:49:59 UTC

    Confirmed on-chain · read-only JSON-RPC lookup of the transaction and its block · checked 2026-10-19

Explorer links use the chain we confirmed for each item. Where no explorer is configured, or a chain is not verified, we say so rather than guess.

Associated code

Public PoC metadata

Status
Test or reproduction identified
Dataset
SunWeb3Sec/DeFiHackLabs
Stored commit
7363f76db51f0fea97f8e659b20ee8bdc5fbca25
Directory / file
src/test/2026-10/UNCXSmartTokenVesting_exp.sol
Framework
Foundry
Licence
file MIT; repository Apache-2.0
Seen at pin
yes · retrieved 2026-10-19
Repository claim
~88-89K USD across five ERC-20s on Ethereum, retained after the per-token flash loans are repaid and each reproduced to the wei against the tx transfer logs (EDGEN 55,601,598.708417972560603048, ZC 9,055,847.637887682268154756, pepecoin 40,
Note
Reproduction metadata only. ThreatWire has not run it and does not treat a repository entry as proof that anything is exploitable.

Remediation and defensive indicators

Defensive lessons from the class

  • Write the invariant down and test it in every call order.
  • Update every record in the same place a quantity changes.
  • Do not treat a single-block price as truth.
  • Assume any bug that needs capital can be funded for free.

Sources

Similar incidents

Read the full written analysis

Method, uncertainty and corrections

Still unknown

  • Outcome for affected projects

Where sources disagree

  • $1.49M (Blockaid tally) versus about $808K (UNCX realised value).

Written by ThreatWire editorial. Facts attributed to the sources listed; figures are estimates and not independently verified unless marked on-chain. Published 2026-10-19, last updated 2026-10-19. Figures are estimates from public post-mortems and named analysts; not independently verified unless marked as confirmed on-chain.

No corrections recorded since publication.