UNCX Network is containing a multi-chain exploit affecting its Vesting V2 contracts after an accounting vulnerability allowed attackers to withdraw assets belonging to unrelated vesting positions. Blockaid now estimates approximately $1.49 million was drained across 11 transactions on four blockchain networks, substantially expanding the initial $86,000 Ethereum estimate reported when the attack was first detected.
In its official security update, UNCX said the incident is limited to Vesting V2 and affects 10 tokens across Ethereum, Base, BNB Chain and Robinhood Chain. The protocol says its liquidity-locking contracts and legacy vesting contracts remain unaffected, narrowing the security boundary to the newer shared token-vesting infrastructure. UNCX’s own documentation lists separate Vesting V2 deployments across supported networks.
The affected assets are pepecoin, EDGEN, ZC, X, LO0P and PAAL on Ethereum; IMO on Base; BTCLE on BNB Chain; and CASHCAT and RKST on Robinhood Chain. Being listed as affected does not mean every token suffered the same dollar loss, because available liquidity, vesting balances and attacker execution differed across pools.
UNCX Vesting V2: Security Incident Update
Following the security incident affecting our Vesting V2 contracts across several chains earlier today, we want to share an update on the measures taken, the affected tokens, and what comes next.
1. Security measures and containment
We…
— UNCX Lockers (@UNCX_token) October 14, 2026
Share Accounting Allowed Repeated Withdrawals
Security researchers attribute the exploit to how the VestingManager contract accounts for shares in pools where tokens belonging to multiple vesting positions are held together. ExVul’s preliminary analysis found that the release() function reduced the pool’s global _totalTokenShares without correspondingly reducing the position’s recorded _depositedShares.
An attacker could then top up a position, manipulate the pool balance through a direct token transfer and cancel the modified vest. During cancellation, shares that had effectively already been removed could be deducted from the global accounting again. That double-counting distorted the relationship between outstanding shares and the assets backing them, allowing a remaining position to claim tokens economically belonging to other vesting schedules.
The initial Ethereum transaction affected five tokens and was valued by Blockaid at approximately $86,000. PublicAML later found that selling those assets generated about 14.93 ETH, worth roughly $36,000 at its observation time, while some ZC remained unsold. The nominal value of tokens removed from a vesting pool therefore differs from the amount an attacker can actually realize through available market liquidity.
The incident subsequently expanded as other wallets replicated the technique. Blockaid’s October 15 estimate attributes roughly $969,000 to BNB Chain, $242,000 to Ethereum, $169,000 to Robinhood Chain and $114,000 to Base. Those figures represent the security firm’s current incident estimate rather than a final loss reconciliation published by UNCX.
UNCX Raises Fees to Contain Further Exploitation
UNCX responded by making additional Vesting V2 interactions economically prohibitive while the vulnerable system is investigated. The project increased fixed fees to more than 1,000 ETH per new lock, removed interactions capable of bypassing those fees and raised the token fee to the contract’s maximum 5%. These measures are containment controls rather than a confirmed software fix for the underlying accounting defect.
The team is coordinating with law enforcement, security researchers and SEAL 911 and has contacted most affected projects. No attacker funds had been confirmed returned in UNCX’s latest update, while a complete incident report and recovery plan are expected separately. Until a patched contract or migration is documented, raising transaction costs should not be described as eliminating the original vulnerability.
The security boundary also distinguishes this event from incidents involving compromised administrators or external integrations. A recent Grail.xyz breach involved privilege escalation and unauthorized token minting, while a FlashLoopAdapter exploit exposed assets through flawed delegated authorization. UNCX’s available evidence instead points directly to accounting behavior inside its Vesting V2 contracts.
A similar accounting lesson emerged when a legacy Set Protocol product was exploited through a rounding flaw. Shared accounting systems can turn a discrepancy affecting one position into exposure for assets deposited by unrelated users, particularly when claims are calculated against a common contract balance.
For UNCX, the current incident is therefore broader than the original $86,000 Ethereum alert but narrower than a compromise of the entire platform. The best-supported current estimate is approximately $1.49 million across Vesting V2 deployments on four chains, while LP lockers and legacy vesting contracts remain outside the confirmed impact. A final loss figure, recovery accounting and permanent remediation will depend on UNCX’s forthcoming postmortem.