UNCX Vesting V2 exploit drains $1.49 million across 4 chains

UNCX Network’s Vesting V2 contracts were exploited for about $1.49 million across four blockchains, according to blockchain security firm Blockaid. The attack began with an $86,000 withdrawal on Ethereum before copycat wallets and trading bots used the same flaw.

Blockaid identified 11 drain transactions. Losses totaled about $969,000 on BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base.

The flaw was in UNCX’s VestingManager contract, which tracks token allocations scheduled for release. UNCX, formerly known as Unicrypt, lets crypto projects lock liquidity and release team and investor tokens according to set schedules.

Researchers at ExVul found that the contract’s release() function reduced the total number of vesting shares without removing the released shares from the related position’s recorded deposit. When the position was later canceled, the same shares were deducted again.

An attacker could create vesting positions, release a large position, send more tokens to the contract and cancel a topped-up position. The process created a small remaining position that could withdraw tokens assigned to other users. No private keys were compromised; the contract’s accounting enabled the withdrawals.

The affected tokens were pepecoin, EDGEN, ZC, X, LO0P and PAAL on Ethereum; IMO on Base; BTCLE on BNB Smart Chain; and CASHCAT and RKST on Robinhood Chain. About $3.25 million remained in the affected Ethereum contract when Blockaid identified the attack.

UNCX reported that its liquidity lockers and legacy vesting contracts were unaffected. To limit further losses, the company raised flat fees for new locks above 1,000 ETH, removed routes that could bypass fees and increased the token fee to the contract’s maximum of 5%.

UNCX is coordinating with law enforcement and SEAL 911 on a recovery plan. No funds had been returned by the original attacker or copycat wallets on any of the four chains. The platform advised users not to trade in affected liquidity pools until the relevant token teams issue guidance.

The company had expected to publish an incident report during the week of Oct. 12, covering the technical findings, financial losses and proposed recovery measures.