Public incident disclosure

Smart Token Vesting V2
Cross-Chain Incident Report

StatusPublic report

Published15 Oct 2026

Version2.0

DocumentSTV2-IR-2026-10-14

Public report of confirmed Smart Token Vesting V2 token outflows across four networks.
Incident window: 14 October 2026 · Exploit-pattern rescan cutoff: 15 October 2026, 16:40:35 UTC · Inventory status: no material tokens awaiting disposition after Ethereum block 26,205,564 · Sources: transaction receipts, ERC-20 transfer logs and verified liquidation flows.

What happened

Attackers manipulated vesting share records and withdrew pooled tokens allocated across other vesting positions.

UNCX Smart Token Vesting V2 pools each token and tracks vesting positions with internal shares. On 14 October 2026, attackers found a sequence of public vesting actions that corrupted those share calculations. This allowed attacker-controlled positions to withdraw more tokens than the attackers had supplied, leaving the manager with fewer pooled tokens than its share records represented.

4 affected networks 10 affected tokens 11 confirmed drain transactions Reviewed exploit calls did not use admin functions Net manager outflow is reported token by token

Confirmed affected contracts

Ethereum 0xA98F06312b7614523d0f5e725e15fd20fB1b99F5 BNB Chain 0x7f3f9f4ED8987B78adC448a840169A0FD5AFFAAB Base 0x7ca3dE7D58A0bCAd115184597553485A919320c5 Robinhood 0xB31eAEFA2A0bdC53Df6D7a7f0f289b6eE1a8AAF3

Attack mechanics

How one drain worked

Each confirmed drain used the same share-accounting failure. The calls were public; the attacker’s advantage came from making the pooled token balance and recorded global share supply disagree.

Create and release

An immediately vested, top-up-enabled position was released. Its active shares left global supply, while historical deposited-share data remained attached.

Restore tokens, not shares

Tokens were sent directly or supplied with flash liquidity. The manager balance increased without issuing matching shares, raising the token-per-share ratio.

Top up at the new ratio

The already released position was topped up against that distorted ratio and received only a small amount of new shares.

Cancel using old history

Cancellation reused the original deposited-share record, ignored shares already released and removed too many shares for only a nominal token refund.

Withdraw the excess

With global shares understated, a small retained position converted into a disproportionate amount of tokens from the shared pool.

Result Some attacks completed atomically; split variants performed the final release in a linked transaction. Reported manager outflow excludes temporary flash volume.

Accounting rule. Net VestingManager token outflow is calculated after removing attacker deposits and flash repayments. LP extraction is quote currency received minus the attacker’s own buys or liquidity contribution. Gross cyclic transfers and post-crash spot prices are excluded. This page supersedes the earlier post-incident mark-to-market aggregate for incident accounting and profit analysis.

Cross-chain economic summary Realized routes + current inventory

≈$807,609

Realized / routed economic value

82.14M X
23.8682 ETH

Verified returned assets

Verified post-incident return transactions

Chain breakdown: BNB Smart Chain ≈$567,501, Ethereum ≈$77,167, Robinhood ≈$124,588, and Base ≈$38,353. Realized ETH routes use transaction-time Chainlink ETH/USD; stablecoins use their contemporaneous USD basis. Attacker principal and UNCX-controlled fee assets are excluded. Several non-BSC figures remain before gas, so the total is intentionally approximate. Returned assets are listed below by exact token amount without a separate USD valuation.

Token-flow accounting by asset

Net VestingManager outflow is measured after subtracting attacker-supplied tokens. “Arithmetic difference” is the net manager outflow minus the incident-linked fee-wallet receipt. These labels describe observed on-chain accounting only. Click any abbreviated token amount to reveal full precision.

Chain	Asset	Net VestingManager token outflow	Incident-linked fee-wallet receipt	Arithmetic difference	Realized / routed proceeds	Disposition / market reference	Evidence
Ethereum	X	150M `150,000,000`	1.80M `1,804,066.938938624`	148.20M `148,195,933.061061376`	≈8.1401 ETH routed initially + ≈2.5237 ETH from the later sale	Partially sold / returned	Drain + route Later sale Return DEX
Ethereum	EDGEN	57.34M `57,344,850.920661998815573170`	425.56K `425,556.138682232937672685`	56.92M `56,919,294.781979765877900485`	≈8.5679 ETH	Liquidated	Drain Sale DEX
Ethereum	ZC	10.93M `10,928,879.766814890334634473`	91.80K `91,796.108182082773895092`	10.84M `10,837,083.658632807560739381`	Primary: ≈6.5155 ETH	Liquidated except 1 wei	Primary Withdrawal Primary sale Copycat 1 Copycat 2 V4 state DEX
Ethereum	LO0P	65.83K `65,825.999999999993437512`	453.78 `453.782940840000000000`	65.37K `65,372.217059159993437512`	≈3.4631 ETH	Liquidated	Drain Sale DEX
Ethereum	PEPECOIN	42.20K `42,200.532676727856523019`	446.14 `446.139542453412314759`	41.75K `41,754.393134274444208260`	≈2.1937 ETH	Liquidated	Drain Sale DEX
Ethereum	PAAL	115.95K `115,945.629884539`	799.29 `799.291296850`	115.15K `115,146.338587689`	≈0.4119 ETH	Liquidated	Drain Sale DEX
BNB Smart Chain	BTCLE	194.64K `194,640.239999957892933993`	`0`	194.64K `194,640.239999957892933993`	≈567,481.43 USDT + ≈0.0275 BNB net	Liquidated	Drain Sale Rebate DEX
Robinhood	CASHCAT	769.66K `769,661.096588101021335782`	5.71K `5,711.654997780300960387`	763.95K `763,949.441590320720375395`	≈34.5598 ETH-equivalent before gas	Liquidated	Pre-state swap Second-pool baseline Drain + sale DEX
Robinhood	RKST	30.03M `30,032,063.326874479581748141`	390.43K `390,431.913471513434237801`	29.64M `29,641,631.413402966147510340`	≈16.6142 ETH net extraction	Liquidated	Pre-state swap SPCX/USDG SPCX/WETH Drain Sale DEX
Base	IMO	200.80K `200,797.953605048938826819`	`0`	200.80K `200,797.953605048938826819`	≈15.7953 ETH	Sold / returned	Pre-state swap Primary Residual 3 Residual 2 Residual 1 1-wei cleanup DEX

Realized and routed proceeds are shown only in the assets actually received, including ETH, WETH, ETH-equivalent assets, USDT, USDC and BNB. This table does not assign USD conversions or spot-price notionals to the affected or returned tokens.

The hero does not mechanically add every bold token-row value. EDGEN, LO0P, PEPECOIN and PAAL show gross sale outputs individually, while the hero consolidates that primary Ethereum cluster once at its verified 13.721732302440309217 ETH retained amount after EOA gas and fees. This avoids double-counting gross routes and setup capital.

Current token inventory status

Zero material tokens are awaiting disposition.
The 82,143,476.362922687 X held in the earlier snapshot was returned on 16 October 2026 in transaction 0xf0ae…7301. Copycat 2’s exact 1 wei ZC residue remains economically de minimis.

BTCLE capital and liquidation sequence

Exact USDT movements for wallet 0x6167…c25d. Negative values are the attacker’s own funds entering the sequence. The attacker bought 1,248.009363487894 BTCLE, supplied 201 BTCLE to the manager and spent 422.273772491557 BTCLE on sixteen Pancake flash premiums.

Stage	Transaction	USDT wallet delta	Treatment
Initial funding / buy	0xca39…e04d	`−400,000.000000000000`	Attacker capital
Partial sale	0xa30a…a54a	`+258,333.231322308036`	Capital recovered; excludes 14.639514 USDT sent to a KyberSwap-route fee recipient whose ownership is unconfirmed
Second buy	0x2b1f…cdaf	`−259,956.817196356676`	Attacker capital
Final post-drain sale	0x8a3f…53be	`+969,105.018979736461`	Gross payout to attacker
Known incident gas	26 attacker-originated transactions	`−0.00847342335 BNB`	Attacker cost
Same-block MEV rebate	0xf14e…c721	`+0.035977989243759159 BNB`	Traced attacker receipt
Net extraction after known native flows	Full traced sequence	`+567,481.433105687821 USDT +0.027504565893759159 BNB`	Before untraced private-order-flow costs

View all 26 attacker-originated BSC transactions

Verified liquidation paths

Quote assets delivered by pools or routers. Profit is only stated where attacker-funded cash flows have been netted.

Chain / asset	Sale evidence	Quote assets out	Attacker funds / principal	Net extraction / profit status
BNB · BTCLE	Final sale Rebate	969,105.018979736461 USDT +0.035977989243759159 BNB rebate	401,623.585874048640 USDT committed; 0.00847342335 BNB gas	567,481.433105687821 USDT + 0.027504565893759159 BNB after known native flows
Ethereum · primary bundle	PEPECOIN EDGEN LO0P PAAL	14.636607026266583654 ETH sales +0.29 ETH residual	3.5 ETH principal; exactly returned	13.721732302440309217 ETH retained after EOA gas/fee adjustments and excluding unrelated tiny inbounds
Ethereum · X	Atomic unwind Later sale Return	9.490107394654478178 WETH initial +2.524138975886563339 ETH later	Initial sender gas/value: 0.004038171928089639 ETH; later transaction gas: 0.000461536950293685 ETH	Initial route: 8.131967287260 ETH to validator/builder, 0.008140107395 ETH to helper and 1.35 ETH to UNCX. Later route: 2.523677438936 ETH after gas. The remaining 82,143,476.362922687 X was returned on 16 October.
Ethereum · primary ZC	Child withdrawal Sale	6.518678985642082304 ETH	Post-drain withdrawal + sale gas: 0.003198471255186607 ETH	6.515480514387 ETH after those two transaction fees. No primary ZC remained.
Ethereum · ZC copycat 1	Atomic ZC sale USDC → ETH	2,805.196090 USDC	0.101131248416 ETH value + traced gas	Exact P&L vector: +2,805.196090 USDC −0.101131248416 ETH; later ETH sale commingled 368.865711 pre-owned USDC
Ethereum · ZC copycat 2	MEV bundle	0.116876960769225854 WETH gross	Separate executor supplied 0.1 ETH; common ownership unproven	EOA net was +0.000045304801 ETH. If executor and EOA are one actor, bundle net was −0.099954695199 ETH. The copycat contract retains exactly 1 wei ZC.
Robinhood · CASHCAT	Drain + atomic sale	34.709805204905 WETH-equivalent	0 CASHCAT and 0 ETH top-level; 2,001,118.852129 CASHCAT flash principal repaid with 20,011.188521 premium	34.559805204905 ETH-equivalent before gas; 34.559738774293 after 0.000066430613 ETH gas. 0.15 ETH went to UNCX.
Robinhood · RKST	KyberSwap sale Relay deposit Ethereum fill	17.242117565122 ETH route output	100M RKST temporary principal repaid with zero premium; 0.16 ETH supplied and 0.01 ETH returned, so 0.15 ETH net capital	16.614242368015 ETH net extraction before gas; 16.612120941222 after drain/sale gas. A 16.5 ETH bridge deposit delivered 15.999047578325 ETH after 0.500952421675 ETH haircut plus 0.000000566607 ETH bridge gas.
Base · IMO	Primary Residual 3 Residual 2 Residual 1 1-wei cleanup	15.795326237928699981 ETH	0 token/native capital; 371,980.328823 IMO flash principal repaid with 3,719.803288 premium	Exact LP quote extraction before gas. Four exploit sales left 1 wei IMO, consumed in the linked cleanup; total top-level fees were 0.000492193461 ETH and were partly paid by other senders.

Included

Net VestingManager token outflows, verified LP/DEX payouts, attacker-funded buys, returned principal and flash repayment. UNCX-controlled assets are not treated as attacker proceeds.

Post-incident white-hat returns

White hats involved after the incident returned the following assets. These entries document completed on-chain transfers by exact token amount. No USD value is assigned.

Network	Asset	Amount returned	Transfer time (UTC)	Return details	Transaction
Ethereum	X	`82,143,476.362922687 X`	16 Oct 2026 `14:02:11`	Returned by a white-hat participant	`0xf0ae…7301`
Ethereum	ETH	`8.10335 ETH`	16 Oct 2026 `14:01:35`	Returned by a white-hat participant	`0x0761…02d2`
Base	ETH	`15.764812886973556558 ETH`	15 Oct 2026 `13:42:09`	IMO-related return sent directly to the project by `c0ffeebabe.eth`	`0x7ed6…d37ca`

Incident summary and next steps

On 14 October 2026, attackers used a sequence of public Smart Token Vesting V2 actions to make pooled token balances and recorded shares diverge. This enabled attacker-controlled positions to withdraw excess assets across four networks. The sections above document the confirmed token flows, liquidation paths and post-incident returns identified so far.

UNCX is continuing to review the technical evidence, returned assets and possible next steps with legal counsel and other relevant advisers. This work needs to be completed carefully. We ask affected users and the wider community for time, patience and understanding while the review continues. Verified updates will be published through official UNCX channels when there is information to share. No individual outcome or timetable can be confirmed at this stage.

What affected users can do now
If you have information that may be relevant to the incident, please contact us using the dedicated email below. Otherwise, we ask for patience while the technical and legal review continues and recommend following official UNCX channels for verified updates.

Incident contact: [email protected] Do not send private keys, seed phrases, passwords or funds by email.