A stale share counter in UNCX Vesting V2 let attackers drain $1.49 million across four chains
UNCX's Vesting V2 contracts lost about $1.49 million across four chains, Blockaid said, after a release function left a stale share counter. Immunefi's head of security says the contract never enforced a rule keeping the global share total consistent across functions.
The Investor · Invest desk
Bars showing each chain's part of the about $1.494 million in losses Blockaid counted: BNB Smart Chain about $969,000, about 65%; Ethereum $242,000; Robinhood Chain $169,000. Base, at $114,000, is not plotted.
- BNB Smart Chain, approximately, claim 21 $969,000 of $1,494,000 lost 65%
BNB Smart Chain, approximately The whole
- Ethereum, approximately, claim 5 $242,000 of $1,494,000 lost 16% computed
Ethereum, approximately The whole
- Robinhood Chain, approximately, claim 5 $169,000 of $1,494,000 lost 11% computed
Robinhood Chain, approximately The whole
| Share | Part | Whole | Percent | Claim |
|---|---|---|---|---|
| BNB Smart Chain, approximately | $969,000 lost | $1,494,000 lost | 65% | 21 |
| Ethereum, approximately | $242,000 lost | $1,494,000 lost | 16% (computed) | 5 |
| Robinhood Chain, approximately | $169,000 lost | $1,494,000 lost | 11% (computed) | 5 |
What happened
- Blockaid's breakdown was $969,000 on BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base, about $1.494 million combined.
- Immunefi's Gonçalo Magalhães said the cancel function then read the unchanged counter and subtracted the unvested portion again, which inflated the value assigned to the remaining shares.
- In the attack he described, the exploiter opened three positions, sacrificed two through withdrawal and cancellation, and left the third eligible for a withdrawal with a "massive profit".
- UNCX said on X on Oct. 14 that the incident is isolated to Vesting V2, with its liquidity pool lockers and legacy vesting contracts unaffected, and that 10 tokens were involved.
Why it matters
- Who's exposed exposure Holders of the 10 affected tokens are told to stay out of the related liquidity pools until each project team issues guidance. The cost of a vesting-contract bug lands on traders who never used the vesting product.
- What it costs cost No funds had come back from the main attacker or the copycats at the last update. Magalhaes says providers and affected projects share responsibility for reimbursement. The recovery bill sits with UNCX and the projects.
- What it limits constraint Token fees are already at the 5% maximum the Vesting V2 contracts permit and cannot go higher. Any further tightening has to come from somewhere other than the token-fee setting.
- Who has to decide decision A security firm watching a live drain has to choose its order of contact: the team that may be able to pause first, then large depositors. A public call to withdraw comes only when those routes are exhausted.
Blockaid said on Oct. 15 that the total had reached about $1.49 million [1], roughly 17 times the $86,000 it first flagged on Ethereum a day earlier [2]. It counted 11 drain transactions, some from copycat addresses and MEV bots [3]. BNB Smart Chain's $969,000 is about 65% of the $1.494 million that the four chain figures add up to [5][21].
Two accounts describe the same fault. Gonçalo Magalhães, head of security at Immunefi, told crypto.news that the release function failed to deduct released shares from a position's counter [7]. ExVul, which examined the first Ethereum transaction, attributed the attack to an accounting discrepancy in the VestingManager contract. That discrepancy let a small leftover position withdraw tokens deposited by other users of the shared pool [6].
In our view the same check applies to pooled vesting contracts beyond UNCX. A contract that holds many depositors' tokens against one global share total has to move each position's counter and that total together on every path. Magalhães said this one did not: "Ultimately, the smart contract failed to make sure that no functions could break the invariant around the shares' global counter." [10] The safeguard he named is a rule that every operation preserves the accuracy of the total share count [11].
UNCX's own scoping points the other way [12]: an older codebase from the same team did not fail this way, so the defect may belong to V2's implementation and not to pooled vesting itself. No source reports a second protocol with the same flaw. The test is whether the position shares still sum to the global counter after each release or cancel. We would be wrong if audits of other pooled vesting contracts find the counter updated on every release and cancel path, and right if one fails that test.
UNCX's levers all sit on the cost of using the contract. The Crypto Times reports the early step as a fee of 100 ETH or its equivalent [15] and the latest as flat fees above 1,000 ETH per new lock [14]. In Magalhães's account the exploiter opened three positions [9]. If each paid the new fee, the bill is more than 3,000 ETH, and 3,000 ETH is worth more than the $1.494 million taken at any ETH price above roughly $498 [20]. We'd expect a fee that size to stop legitimate new locks as well. UNCX said the changes are meant to make further exploitation economically unviable while its investigation continues [16].
What to watch
- Whether UNCX or the affected token teams announce reimbursement terms or any returned funds.
- Whether UNCX publishes a post-mortem or a change to the release and cancel logic, since the latest listed steps are fee changes.
- Whether another pooled vesting protocol discloses the same global-counter defect. That would widen the lesson beyond Vesting V2.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap−5
- Incentives50
- Confidence70
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Blockaid said on October 15, 2026 that losses from the exploit of UNCX Network's Vesting V2 smart contracts had grown to about $1.49 million across four blockchains.
- [2]
The $1.49 million figure is roughly 17 times the $86,000 that Blockaid first flagged on Ethereum a day earlier.
- [3]
Blockaid counted 11 drain transactions in total, including activity from copycat addresses and maximal extractable value (MEV) bots.
- [4]
As of the update, no funds had been returned by the primary attacker or the copycat addresses.
- [5]
Blockaid's October 15 update broke the losses down as approximately $969,000 on BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base, about $1.494 million combined.
- [6]
Security researchers at ExVul, who examined the first Ethereum transaction, attributed the attack to an accounting discrepancy in UNCX's VestingManager contract that allowed a small leftover position to withdraw tokens deposited by other users of the shared pool.
- [7]
Gonçalo Magalhães, head of security at Immunefi, told crypto.news that after a withdrawal the release function failed to subtract the released shares from the position's counter.
- [8]
Magalhães said that when the cancellation function subsequently read the unchanged counter value, it subtracted the unvested portion again, distorting the pool's accounting and inflating the value assigned to the remaining shares.
- [9]
In one attack Magalhães described, the exploiter opened three vesting positions and sacrificed two through the withdrawal and cancellation functions; the remaining position became eligible for a withdrawal carrying what he described as a "massive profit".
- [10]
Magalhães said: "Ultimately, the smart contract failed to make sure that no functions could break the invariant around the shares' global counter."
- [11]
The safeguard Magalhães identified was a rule ensuring that every operation preserved the accuracy of the total share count.
- [12]
UNCX confirmed in a statement on X on October 14 that the incident is isolated to Vesting V2 contracts, and said its liquidity pool lockers and legacy vesting contracts remained unaffected on all supported chains.
- [13]
UNCX said 10 tokens were involved in the incident, across Ethereum, Base, BNB Chain and Robinhood Chain.
- [14]
UNCX said it introduced flat fees above 1,000 ETH per new lock, removed client and contract interactions that had allowed users to bypass fees, and raised token fees to 5%, the maximum the Vesting V2 contracts permit.
- [15]
UNCX's early response included temporary restrictions on new vesting positions and a fee increase to 100 ETH or its equivalent.
- [16]
UNCX said the fee changes are meant to make further exploitation economically unviable while its investigation continues.
- [17]
UNCX advised holders of the affected tokens to avoid trading in the related liquidity pools until each project team issues further guidance.
- [18]
Magalhães said providers and affected projects share responsibility for working toward reimbursement.
- [19]
Magalhães's first recommendation for an active exploit was to contact the affected team privately because operators may have a way to pause activity; contacting large depositors comes next, and a public warning urging withdrawals is the last option.
- [20]
Three new locks at more than 1,000 ETH each would cost more than 3,000 ETH, which is worth more than $1.494 million at any ETH price above roughly $498.
- [21]
BNB Smart Chain's $969,000 is about 65% of the $1.494 million the four chain figures sum to.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- crypto.newsUNCX exploit exposes share-accounting flaw behind reported $1.5M loss
1 article · October 16, 2026
- cryptotimes.ioVesting V2 Bug Drains ~$1.5M Across 4 Chains as Copycats Join In
1 article · October 15, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.