# UNCX Vesting Bug Lets Attackers and Copycats Drain $1.5 Million Across Four Chains

A share counter that was never decremented after withdrawals let attackers inflate their claims on a shared token pool, and a smaller Uniswap v4 hook drain this week came from reading a price that could be manipulated.

- Published: 2026-10-17T05:38:56.693Z
- Canonical: https://polylog.news/crypto/2026-10-17/uncx-vesting-bug-lets-attackers-and-copycats-drain-1-5-milli
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [crypto.news](https://crypto.news/uncx-exploit-exposes-share-accounting-flaw-behind-loss/), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/6e9c6074d9a880df194c76748b6a2d330bdf3bc3), [The Crypto Times](https://www.cryptotimes.io/2026/10/15/uncx-exploit-escalates-vesting-v2-bug-drains-1-5m-across-4-chains-as-copycats-join-in/), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/7363f76db51f0fea97f8e659b20ee8bdc5fbca25), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/0252d93789b09cca91a5537189369f428b8097a2), [DeFiHackLabs](https://github.com/SunWeb3Sec/DeFiHackLabs/commit/b29ee9bdb3ca655bc233fb8b30e0ac5748196745)

Attackers drained about $1.5 million from UNCX's Vesting V2 contracts on BNB Smart Chain, Ethereum, Robinhood Chain and Base. Immunefi's head of security, Gonçalo Magalhães, explained to crypto.news that the root cause was a share-accountin…

This story is for subscribers. Read it in full at https://polylog.news/crypto/2026-10-17/uncx-vesting-bug-lets-attackers-and-copycats-drain-1-5-milli (subscription information: https://polylog.news/pricing).