TREE NEWS update: An attacker exploited UNCX Network’s Smart Token Vesting V2 on Oct. 14, using a set of public vesting operations to create a mismatch between pool token balances and recorded shares, allowing controlled positions to withdraw excess tokens. The exploit hit Ethereum, BNB Chain, Base and Robinhood across 10 tokens in 11 confirmed withdrawal transactions, with verified economic value of about $807,600, of which BNB Chain accounted for roughly $567,500. None of the calls used admin privileges, and white hats have since returned 82.1435 million X tokens and 23.8682 ETH.
UNCX Smart Token Vesting V2 Exploit Drains $807,600 Across Four Chains
The detail that no admin privileges were needed is the part that matters: the flaw sat in ordinary, publicly callable vesting logic, so any protocol reusing similar share-versus-balance accounting carries the same exposure. The concentration on BNB Chain, and the fact that token projects rather than a single issuer absorbed the loss, points to vesting contracts as an under-watched attack surface across chains. Whether other deployments of comparable vesting code are checked, and whether the returned X tokens and ETH form part of a fuller recovery, are the open questions.
Generated by AI for reference only.
Share on WeChat
Open WeChat → Scan → then tap "…" to send to a chat or Moments.
Tap "…" in the top-right corner to send to a chat or share to Moments.