Losses from an exploit targeting UNCX Network’s Vesting V2 smart contracts have grown to about $1.49 million across four blockchains, blockchain security firm Blockaid said on October 15, 2026. The figure is roughly 17 times the $86,000 that Blockaid first flagged on Ethereum a day earlier, and the attack has since spread to BNB Smart Chain (BSC), Robinhood Chain and Base, with copycat wallets and automated trading bots joining the original attacker.
UNCX Network, formerly known as Unicrypt, is a multi-chain platform that lets crypto projects lock liquidity and set up token vesting. Vesting contracts hold tokens and release them on a fixed schedule, typically to team members, early investors, or partners, so that large allocations cannot be sold all at once.
How the UNCX Exploit Spread Across Four Chains
According to Blockaid’s October 15 update, the losses broke down as approximately $969,000 on BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. Combined, those figures equal about $1.494 million, with BSC alone representing close to two-thirds of the total.
Blockaid counted 11 drain transactions in total. These included activity from copycat addresses, meaning wallets that appear to have replicated the original attack method, as well as maximal extractable value (MEV) bots. MEV bots are automated programs that scan pending blockchain transactions and reorder or copy profitable ones, which can accelerate losses once an exploit becomes public.
The security firm also published a timeline chart showing that its system detected pre-exploit activity on October 14 at 14:50 Coordinated Universal Time (UTC), about one hour before the first drain. Blockaid issued its first public alert at approximately 16:26 UTC that day.
The BSC chain is the Ethereum-compatible smart contract network within the BNB Chain ecosystem. Base is an Ethereum layer-2 network incubated by Coinbase, and Robinhood Chain is the blockchain network developed by trading platform Robinhood.
What Went Wrong in the Vesting V2 Contracts
Security researchers at ExVul, who examined the first Ethereum transaction, attributed the attack to an accounting discrepancy in UNCX’s VestingManager contract. The flaw involved how the contract tracked vesting shares that had been released or canceled, which allowed a small leftover position to withdraw tokens deposited by other users of the shared pool.
The Crypto Times previously reported the initial $86,000 Ethereum drain, along with UNCX’s early response, which included temporary restrictions on new vesting positions and a fee increase to 100 ETH (Ether) or its equivalent.
10 Tokens Affected, Liquidity Lockers Unaffected
UNCX confirmed in an official statement on X on October 14 that the incident is isolated to Vesting V2 contracts. The team said its liquidity pool lockers and legacy vesting contracts remained unaffected on all supported chains.
The project said 10 tokens were involved:
- Ethereum: pepecoin, EDGEN, ZC, X, LO0P and PAAL
- Base: IMO
- BNB Chain: BTCLE
- Robinhood Chain: CASHCAT and RKST
UNCX Raises Fees to Block Further Drains
To contain the exploit, UNCX said it introduced flat fees above 1,000 ETH per new lock, removed client and contract interactions that had previously allowed users to bypass fees, and raised token fees to 5%, the maximum the Vesting V2 contracts permit. The team said the changes are meant to make further exploitation economically unviable while its investigation continues.
UNCX also advised holders of the affected tokens to avoid trading in the related liquidity pools until each project team issues further guidance. The project said it is in contact with most of the affected teams and is coordinating with law enforcement and SEAL 911, the emergency incident response service run by the Security Alliance (SEAL). As of the update, no funds had been returned by the primary attacker or the copycat addresses.
UNCX Exploit Adds to a Busy Year for Onchain Attacks
The incident is the latest in a series of exploits tracked by Blockaid, an onchain security company whose threat detection tools are integrated by wallets and platforms including MetaMask and Coinbase. In September, the firm flagged an exploit of older Flamincome contracts linked to FlamingoFinance, in which an attacker used an $18 million USDT flash loan to extract about $345,900.
Blockaid’s H1 2026 Onchain Security Report, published on July 28, recorded about $1.1 billion in losses across 212 verified exploit incidents in the first half of the year. The firm described the period as the most-hacked half-year on record by incident count, although total dollar losses were below the same period of 2025.
What Comes Next for Affected Projects
UNCX said it expects to publish additional guidance this week, along with a full incident report covering its technical findings and a proposed recovery plan. The project has not yet released a final loss figure.
Blockaid’s $1.49 million total reflects token values at the time of each drain transaction, so the final figure could differ once UNCX completes its review. The scope of any compensation for affected projects will depend on the recovery plan that UNCX has said it will present.
Also Read: Autheo THEO Crashes Over 90% After $1.7M Hyperlane Bridge Exploit on Base
