UNCX Vesting V2 was drained on four chains. The headline said $1.49M, UNCX's own count says about $808K

What happened

On 14 October 2026 someone drained tokens out of UNCX Network's Smart Token Vesting V2 on Ethereum. By the next day the same flaw had been used on three more chains. UNCX counts 10 affected tokens, 4 networks and 11 confirmed drain transactions.

UNCX, formerly Unicrypt, sells token locks and vesting schedules to launch teams. Vesting V2 pools every schedule for a given token in one contract. The money taken did not belong to UNCX. It belonged to token projects and their investors whose schedules shared a pool with the attackers' positions.

Headlines first said about $1.49 million, from an early tally by Blockaid. UNCX's own report, published on 15 October and revised since, gives a lower figure. We come back to that below.

What is confirmed

UNCX's report is the main source. It says reviewed exploit calls did not use admin functions, and that all 22 Vesting V2 deployments it scanned were checked.

• Where. Ethereum, BNB Chain, Base and Robinhood Chain.
• Which tokens. Ten: six on Ethereum, one on Base, one on BNB Chain and two on Robinhood Chain.
• What was not affected. UNCX says LP lockers and legacy vesting contracts are unaffected, and the incident is isolated to Vesting V2.
• Containment. The contract has no pause. UNCX used the levers it had: flat fees above 1,000 ETH per lock, removal of client paths that let fees be bypassed, and token fees raised to the 5% maximum, so that repeated top-ups stopped being worth it.
• Realised value. UNCX's report puts realised and routed economic value at about $807,609: roughly $567,501 on BNB Chain, $124,588 on Robinhood, $77,167 on Ethereum and $38,353 on Base. It calls the total "intentionally approximate". It says this supersedes its own earlier mark-to-market aggregate.
• Returns. The report lists three on-chain returns by whitehats: 82,143,476 units of one token (X) and 8.10 ETH on Ethereum on 16 October, and 15.76 ETH on Base on 15 October. It says no material tokens are awaiting disposition. It assigns no dollar value to the returns.
• Next steps. UNCX is reviewing the evidence with legal counsel and has published an incident contact address. It asks for patience and warns not to send keys, seed phrases or funds by email.

How it worked

A pooled vault pays out by shares. If you own 1% of the shares, you can take 1% of the balance. Everything depends on two numbers agreeing: the total shares, and each position's own share count.

UNCX describes a sequence of public vesting actions that made those records disagree. In the plain language of its report:

An attacker's position was created and released. Releasing took its shares out of the global total, but the older record of how many shares were originally deposited stayed attached to the position. Tokens were then sent into the pool directly, or borrowed in a flash loan, which raised the balance without issuing matching shares. That changed the token-per-share ratio. The same position was topped up at the new ratio and received only a small amount of new shares. Finally the position was cancelled, and cancellation reused the old deposited-share record. It ignored the shares already released and so removed too many shares from the global total.

With the global share count too low, any small remaining position was suddenly worth a lot more than it should be. Releasing it paid out tokens that belonged to other people's schedules.

Nothing about any single step was an admin action. Each one was an ordinary public call. The damage came from the order.

We are deliberately leaving out the exact calls and amounts.

What is not known

• What UNCX will do for affected projects. Its report says no individual outcome or timetable can be confirmed.
• Who the attackers are. UNCX talks of "attackers" in the plural. Independent analysts describe the first attacker and later copycats and MEV bots, but UNCX has not attributed any of it.
• How much of the loss ends up returned. The three whitehat returns are listed, but without dollar values.
• Whether UNCX will redeploy Vesting V2 or retire it.

Where sources disagree

This is the interesting part of the story.

• $1.49M versus about $808K. Blockaid's tally, reported by outlets and used in several write-ups, counts about $1.49 million across 11 drain transactions, priced at token values at the time of each drain. UNCX's report says it supersedes its earlier mark-to-market figure and now counts net outflows, after removing attacker deposits and flash-loan repayments, and valued at what was actually realised on sale. Both are honest, but they measure different things. The first is the nominal value of what left the contract. The second is closer to what the attackers could actually cash out of thin markets.
• $86K versus $1.49M. The first Ethereum transaction was about $86K to $88K according to early alerts. That is one transaction on one chain.
• Who got what. An independent analysis estimates the original attacker's Ethereum address kept about 20 ETH. UNCX's table counts several actors and chains, and we cannot reconcile the two.

The tracker on this site uses UNCX's $808K because it comes from the project and states its accounting rule. The $1.49M is widely quoted.

Lessons

• Write the invariant down and test it. For any pooled vault, the global share total should equal the sum of everyone's shares, after every function, in every order.
• Update every record in the same place you change the quantity. Here a release changed what a position owned and updated only one of the two places where that was recorded.
• Direct token transfers are an input. If balance can rise without shares being issued, your share price can be moved by anyone.
• Ship a real pause. UNCX had to use fee levels as an emergency brake because nothing else existed.
• Prepare the same response for every deployment. Identical code on four chains meant a bug found on one was a bug on all.
• Isolate tenants. Pooling unrelated teams' schedules in one contract let one position reach everybody's tokens.

What users should do

If you launched a token or hold vested tokens through UNCX Vesting V2, check the incident report for your token and contact UNCX through its official channels. UNCX has asked affected pool users not to trade until the token teams give guidance.

Do not send funds or secrets to anyone offering recovery services. UNCX's official contact is the address on its incident page.

Sources: UNCX's incident report, with early tallies from Blockaid, analysis from ExVul and SigIntZero and reporting from The Crypto Times. We did not link the third-party sources. We have not verified the on-chain figures.