An attacker exploited UNCX Vesting V2’s shared token accounting by creating vesting positions, releasing a large position, donating tokens into the pool, and cancelling a topped-up vest. This sequence allowed a small remaining vesting position to withdraw tokens belonging to other users. UNCX confirmed additional affected assets across four chains and introduced emergency fees and restrictions to contain the exploit

UNCX Network’s Vesting V2 contracts had a share-accounting logic vulnerability (VestingManager.cancel failed to ensure retained shares covered already-released amounts). The attacker transferred tokens directly to lower the shares-per-token rate, released and canceled schedules, and drained excess tokens from the shared vesting pool. Initial loss on Ethereum was ~$86k, later escalating to ~$1.49M across multiple chains.