UNCX Smart Token Vesting V2 hack — October 2026
Incident facts
| Date of incident | |
|---|---|
| Publicly disclosed | October 14, 2026 |
| Target type | Other |
| Loss | $807,609Price at time of incident |
| Recovered | $57,917 |
| Method | Contract logic errorVesting V2 pooled each token and tracked positions in shares. release() removed a position’s active shares from the global count but kept its deposit history, and cancel() then removed the same shares again, so a small retained position could withdraw tokens backing other vesters |
| Chains | Multiple chains, Ethereum, BNB Chain, Base, Other |
| Outcome | Partially recovered |
What happened
Attackers drained the Smart Token Vesting V2 contracts of UNCX Network, a token-locking and vesting service, on 14 October 2026, in 11 transactions across Ethereum, BNB Chain, Base and Robinhood Chain. Ten tokens held for other projects’ vesting schedules were taken: PEPECOIN, EDGEN, ZC, X, LO0P and PAAL on Ethereum, BTCLE on BNB Chain, IMO on Base, and CASHCAT and RKST on Robinhood Chain. UNCX’s liquidity lockers and older vesting contracts were not affected, and none of the exploit calls used admin functions.
According to UNCX’s incident report, each drain created an immediately vested position and released it, sent tokens straight into the pool to raise the token-per-share ratio, topped the released position up at that ratio, then cancelled it using its original deposit record. That removed far more shares than it should have, and a small retained position could then withdraw a disproportionate share of the pool. After the first Ethereum drain of about $86,000, copycats and MEV bots repeated the pattern. Blockaid put the total at about $1.49 million on 15 October: $969,000 on BNB Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. UNCX’s own accounting, which nets out the attackers’ capital and counts only what they realised, came to about $807,609: $567,501 on BNB Chain, $77,167 on Ethereum, $124,588 on Robinhood Chain and $38,353 on Base. The headline here is UNCX’s realised figure, with Blockaid’s mark-to-market total as the upper end.
UNCX raised its fees to make further drains uneconomic and offered a 10% bounty. White hats returned 15.76 ETH taken from the IMO pool on Base to the IMO project on 15 October (c0ffeebabe.eth), and 8.10 ETH and 82.1 million X tokens on Ethereum on 16 October. Recovered here is the returned ETH, about $57,900 at CoinGecko’s prices on the days of return; the X tokens are not given a dollar value, and UNCX’s report does not assign one either. UNCX said it is working with law enforcement and SEAL 911 and is reviewing next steps for the affected projects with legal counsel.
Sources
- UNCX Network, Smart Token Vesting V2 incident report (15 October 2026, v2.0)Primary · retrieved 2026-10-21
- UNCX on X, incident update (14 October 2026)Primary · retrieved 2026-10-21
- UNCX on X, Base funds returned (15 October 2026)Primary · retrieved 2026-10-21
- Blockchain Reporter, Blockaid’s figures (16 October 2026)Secondary · retrieved 2026-10-21
- Odaily (17 October 2026)Secondary · retrieved 2026-10-21
Official post-mortem: https://uncx.network/vesting-incident
Changes to this entry
- Recorded once UNCX published its incident report. Earlier excluded at the first Ethereum drain of about $86,000, below the registry’s threshold.
Cite this
This data is published under CC BY 4.0. You may reuse it, including commercially, as long as you credit iTokenly and link back.
iTokenly Hack Registry, "UNCX Smart Token Vesting V2 hack — October 2026", iTokenly, accessed 2026-10-21, https://itokenly.com/hacks/uncx-vesting-v2-october-2026https://itokenly.com/hacks/uncx-vesting-v2-october-2026Permalinks never change. If an entry is renamed, the old address keeps working.
Spotted an error? Write to [email protected]. Corrections to published figures are logged on this page. See the methodology for how entries are checked.