Four Chains, Eleven Drain Transactions, $1.49M, No Refunds
Four chains, eleven drain transactions, and nothing returned.
$1.49 million left UNCX’s Vesting V2 pools on Ethereum, BNB Chain, Robinhood Chain and Base[1]. The first drain hit Ethereum at 15:49:59 UTC on October 14: about $86,000[2][3]. Blockaid logged 11 drain txs, copycats and MEV bots among them[4]. Blockaid put the take at $969,000 on BNB Chain and $242,000 on Ethereum[5]. $169,000 sat on Robinhood Chain and $114,000 on Base[5].
The flaw: release() cut the pool’s share count but left the shares in the record[6]. cancel() then took them off twice, so an open slot claimed a big slice of other plans[7]. UNCX said no funds came back on any chain[8].
What to do: stay out of those pools until token teams give guidance[9].
Who gains, who loses
Receipts
The reported gross drain reached approximately $1.49 million across the four chains.
“🚨 Update: The Unicrypt Vesting V2 (@UNCX_token) exploit has now hit 4 chains.”
The first successful Ethereum drain occurred at 15:49:59 UTC on October 14, 2026.
“The first successful Ethereum drain occurred Wednesday, Oct. 14, at 11:49:59 a.m. ET (15:49:59 UTC).”
The initial Ethereum pool drain was approximately $86,000 in one transaction.
“The cross-chain figure followed the initial Ethereum pool drain of about $86,000 in one transaction.”
The incident comprised 11 drain transactions, including activity by copycat wallets and MEV bots.
“11 drain txs, including copycats and MEV bots.”
Blockaid’s chain-by-chain estimates were approximately $969,000 on BNB Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base.
“Rounded amounts were $969,000 on BNB Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base.”
The accounting flaw involved release() lowering the pool’s overall share count while leaving released shares in the position record, after which cancel() could subtract those shares again.
“When release() paid vested tokens, the system lowered the pool’s overall share count but kept the released shares in the position’s record.”
A second deduction reduced the shares attached to tokens remaining in the pool and allowed an active position to claim an outsized portion of the balance.
“A position that remained active could then claim an outsized portion of the balance, including tokens backing unrelated schedules.”
UNCX said that no funds had been returned by the primary attacker or copycats on any affected chain at the time of its update.
“To date, no funds have been returned by the attackers (primary and copycats) on any affected chain.”
UNCX advised users not to trade in affected pools until further guidance from the respective token teams.
“For all impacted tokens, we strongly advise against trading in the affected pools until further guidance is provided by the respective token teams.”
Cabal Desk is reporting, written with AI under human oversight. Every bracketed number opens its receipt: the source, the quoted span, the hash. Headlines and characterisations are commentary; the sourced facts are the receipts. Not investment advice. Corrections log. Editorial & legal.