Press Enter to search · ESC to close

Crypto DeFi

UNCX Smart Token Vesting V2 Exploit Drains $807,600 Across Four Chains

An attacker exploited UNCX Network’s Smart Token Vesting V2 on Oct. 14, using a set of public vesting operations to create a mismatch between pool token balances and recorded shares, allowing controlled positions to withdraw excess tokens. The exploit hit Ethereum, BNB Chain, Base and Robinhood across 10 tokens in 11 confirmed withdrawal transactions, with verified economic value of about $807,600, of which BNB Chain accounted for roughly $567,500. None of the calls used admin privileges, and white hats have since returned 82.1435 million X tokens and 23.8682 ETH.

Original source

AI take

The detail that no admin privileges were needed is the part that matters: the flaw sat in ordinary, publicly callable vesting logic, so any protocol reusing similar share-versus-balance accounting carries the same exposure. The concentration on BNB Chain, and the fact that token projects rather than a single issuer absorbed the loss, points to vesting contracts as an under-watched attack surface across chains. Whether other deployments of comparable vesting code are checked, and whether the returned X tokens and ETH form part of a fuller recovery, are the open questions.

Generated by AI for reference only.

Share

Related News

TREE NEWS share card
Long-press image above → Save to Photos / Share
Pitch us Feedback