UNCX Exploit Drains $1.5M Across Four Chains

A share-accounting flaw in UNCX's Vesting V2 smart contract enabled attackers to drain approximately $1.5 million across four different blockchain networks, according to CryptoNews. Gonçalo Magalhães, head of security at Immunefi, explained that withdrawal and cancellation functions left share accounting out of balance, allowing exploiters to manipulate global counters and extract pooled tokens.

Accounting Flaw Mechanics

The vulnerability originated in the contract's release function, which permits beneficiaries to withdraw available tokens under a vesting schedule. Following a withdrawal, the function failed to subtract the released shares from the position's counter. When the cancellation function subsequently read that unchanged value, it subtracted the unvested portion again, distorting pool accounting and inflating the value assigned to remaining shares.

According to security reports from Blockaid cited by CryptoNews, the total losses reached roughly $1.49 million across Ethereum, BNB Chain, Base, and Robinhood Chain, with 11 drain transactions involving the original attacker, copycat wallets, and maximal extractable value bots.

Response and Intervention

Magalhães advised that security firms should first attempt private contact with affected teams before issuing public withdrawal warnings. In cases where operations cannot be paused, investigators examine transaction histories to separate original exploiters from copycat wallets and automated trading bots. Both infrastructure providers and affected projects share the responsibility of working toward user reimbursement.

Key facts

• Roughly $1.5 million was drained across four networks, including Ethereum, BNB Chain, Base, and Robinhood Chain.
• The vulnerability stemmed from an out-of-balance share accounting mechanism in UNCX's Vesting V2 release and cancellation functions.
• Blockaid attributed the drain activity to 11 transactions involving the original attacker, copycat wallets, and MEV bots.
• Immunefi security chief Gonçalo Magalhães advised private intervention and coordination between providers and projects for user reimbursement.