UNCX Network vesting contract exploit grows to $1.5 million across four blockchains

An exploit targeting UNCX Network's Vesting V2 contracts expanded from an initial $86,000 Ethereum drain to approximately $1.5 million across four blockchains, including BNB Smart Chain, Base, and Robinhood Chain. ExVul security researchers attributed the breach to an accounting flaw in the VestingManager contract. Blockaid tracked 11 drain transactions involving copycat wallets and automated MEV bots across 10 affected tokens. UNCX Network froze new positions, raised fees above 1,000 ETH, and partnered with SEAL 911 and law enforcement.

Exploit losses and remaining contract funds

• ▪UNCX Network's affected Ethereum smart contract retained approximately $3.25 million in assets following the initial exploit drain.
• ▪Blockaid reported UNCX Network's Vesting V2 exploit losses reached $1.49 million across four blockchains: $969,000 on BNB Smart Chain, $242,000 on Ethereum (initial loss $86,000), $169,000 on Robinhood Chain, and $114,000 on Base.

Technical mechanism of the exploit

• ▪ExVul security researchers identified an accounting discrepancy in UNCX's VestingManager contract where the release() function reduced total shares without updating original deposit records, enabling wrongful withdrawals.
• ▪The UNCX Network attacker created vesting positions, released tokens, donated funds, and canceled topped-up positions to allow a residual position to drain other users' locked tokens.

Contracts and tokens targeted

• ▪The exploit targeted shared token vesting contracts while UNCX Network's liquidity pool lockers and legacy vesting contracts remained unaffected on all supported chains.
• ▪The UNCX Network exploit involved 10 tokens, including pepecoin, EDGEN, ZC, X, LO0P, and PAAL on Ethereum, IMO on Base, BTCLE on BNB Chain, and CASHCAT and RKST on Robinhood Chain.

Blockaid detection and pre-exploit activity

• ▪Blockaid system logs showed pre-exploit activity on October 14, 2026 at 14:50 UTC, roughly one hour prior to the initial drain transaction.
• ▪Blockaid recorded 11 drain transactions executed by the primary attacker, copycat wallet addresses, and automated maximal extractable value (MEV) trading bots.
• ▪Blockchain security firm Blockaid detected the UNCX Network exploit and published public alerts alongside threat intelligence on October 14, 2026.

UNCX Network response and mitigation

• ▪UNCX Network froze new vesting positions, raised flat fees per lock above 1,000 ETH, increased token fees to 5%, and removed fee bypass routes to halt exploitation.
• ▪UNCX Network advised holders of affected tokens to refrain from trading in related liquidity pools while outreach to impacted project teams remained ongoing.
• ▪UNCX Network coordinated with law enforcement and the Security Alliance's SEAL 911 emergency incident response service to investigate the smart contract breach.
• ▪UNCX Network announced plans to publish a full incident report covering technical findings and a proposed recovery plan.