Ten Tokens. Four Chains. UNCX’s Vesting Bug Went Multichain.

UNCX says its Vesting V2 incident affected ten tokens across four chains and told traders to avoid the affected pools. Blockaid estimates roughly $1.49 million across eleven drains; UNCX has not yet published a final loss figure.

By Panther@0xPnthr

October 15, 2026 · 12:36 UTC/3 min read

Panther Journal #015 conceptual monochrome illustration of a cracked vesting clock spilling token discs into four chain lanes, symbolizing the UNCX Vesting V2 exploit. — Conceptual illustration: Panther Journal / AI-assisted artwork

Key points

UNCX confirms ten tokens across Ethereum, Base, BNB Chain and Robinhood Chain were affected by its Vesting V2 incident.
Blockaid estimates roughly $1.49 million across eleven drains; UNCX has not yet published a final loss figure.
UNCX says LP lockers and legacy vesting are unaffected, but advises against trading the affected pools pending project guidance.

PANTHER JOURNAL #015

The UNCX Vesting V2 exploit turns a familiar promise inside out: tokens are supposed to stay put until the schedule says otherwise. A shared accounting failure appears to have turned that clock into an exit.

The first alert looked contained. By October 15, blockchain-security firm Blockaid said the incident had reached four chains, eleven drain transactions and about $1.49 million in estimated token value. UNCX separately confirmed ten affected tokens and advised holders not to trade in the affected pools while project teams prepare guidance.

That is serious. It is also narrower than “UNCX was hacked” or “liquidity locks failed.” The company says its liquidity-pool lockers and legacy vesting contracts were unaffected. The incident is isolated, according to UNCX, to Vesting V2.

What the UNCX Vesting V2 exploit affected

In a statement posted October 14 at 23:01 UTC, UNCX said the incident involved ten tokens across Ethereum, Base, BNB Chain and Robinhood Chain. The affected set it named was:

Ethereum: pepecoin, EDGEN, ZC, X, LO0P and PAAL
Base: IMO
BNB Chain: BTCLE
Robinhood Chain: CASHCAT and RKST

UNCX said no funds had been returned by the primary attacker or copycats. It said it was coordinating with law enforcement and SEAL 911, and promised a fuller incident report, financial accounting and proposed recovery plan.

At 06:19 UTC on October 15, Blockaid estimated approximately $969,000 on BNB Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. Those figures sum to roughly $1.49 million across eleven drain transactions, including activity Blockaid attributed to copycats and MEV bots.

The dollar total is an estimate, not UNCX’s final accounting. Token liquidity matters. PublicAML’s onchain review of the initial Ethereum drain found that tokens marked near $86,000 before sale produced about 14.93 ETH—roughly $36,000 at its stated valuation—because selling into thin pools moved prices. Holders can lose marked value that an attacker cannot fully realize.

The apparent fault was accounting, not the clock

Researchers at ExVul attributed the initial Ethereum exploit to inconsistent share accounting inside the shared VestingManager pool. Their analysis, summarized and checked against transactions by PublicAML, says a released position could leave records out of sync and later withdraw tokens belonging to other positions.

That root-cause description remains a researcher assessment until UNCX publishes its post-mortem. The practical lesson is already visible: a vesting date is only as strong as the contract that accounts for every claim on the shared pool.

UNCX says it raised flat fees above 1,000 ETH per new lock, removed client and contract paths that had bypassed fees, and pushed token fees to the Vesting V2 maximum of 5%. Those are containment measures designed to make the known method uneconomic—not proof that every possible route has been eliminated.

A vesting failure is not a liquidity-lock failure

This distinction matters for memecoin communities. Vesting controls when allocated tokens can be released. A liquidity lock controls the receipt that lets someone withdraw assets from a trading pool. They answer different questions.

UNCX says all of its LP lockers remain unaffected. That claim does not make the ten affected token pools safe to trade: the company itself advises against trading in those pools until the relevant teams issue guidance. Panther’s liquidity-lock verification guide explains how to inspect who controls LP receipts, but it cannot certify an unrelated vesting contract.

If you hold one of the named tokens, verify updates through that token’s official channel and UNCX. Do not treat unsolicited “recovery,” migration or compensation links as legitimate. If you are not in an affected pool, a matching ticker alone is not enough to identify the asset; confirm the chain and contract address.

The Panther takeaway

“Locked” is not one property. It is a chain of assumptions: the right contract, correct accounting, a working schedule and a pool that can honor every claim. UNCX’s final post-mortem may change the numbers, but the immediate instruction is clear: affected pools are paused for judgment, not open for speculation.

Sources and verification

UNCX Vesting V2 security update, October 14, 2026 — primary source for scope, affected tokens, containment and user guidance.
Blockaid multichain update, October 15, 2026 — attributed estimate for chains, loss values and drain count.
PublicAML onchain investigation, October 14, 2026 — transaction review and realized-value caveat for the initial Ethereum drain.
The Crypto Times, October 15, 2026 — independent report on the expanded incident.

Verification note: UNCX had not published its promised comprehensive incident report or final loss figure when this article was prepared. The cover is a conceptual illustration, not a depiction of the contracts or transactions.