The reported losses from UNCX Network's Vesting V2 exploit have expanded to approximately $1.49 million across four blockchains, according to Blockaid's October 15 update as reported by The Crypto Times and Tozvan. The broader estimate supersedes the first alert of roughly $86,000 drained from a shared Ethereum vesting pool.
Blockaid's chain breakdown put about $969,000 on BNB Smart Chain, $242,000 on Ethereum, $169,000 on Robinhood Chain and $114,000 on Base. Those rounded amounts total about $1.494 million. They are a security firm's estimate across the incident, rather than a final loss figure published by UNCX.
The response now covers more than the original Ethereum drain
Blockaid counted 11 drain transactions, including activity attributed to copycat addresses and MEV bots, the two reports said. A copied attack method can spread exposure beyond the wallet that first used it; the enlarged count should therefore not be described as one transaction by one identified person.
UNCX said the incident was confined to Vesting V2 and that its liquidity-pool lockers were unaffected, according to The Crypto Times and TokenPost. It reported restrictions including flat fees above 1,000 ETH, removal of interactions that bypassed fees, and token fees raised to the contract's 5% maximum. These are the project's containment claims, not an independent guarantee that every position is safe.
TokenPost also reported that UNCX was preparing further guidance, an incident report and a recovery plan. The existence of that plan is different from a completed reimbursement. The outcome for affected projects still depends on the findings, recoveries and terms eventually published.
Token valuations and sale proceeds measure different losses
The first Ethereum transaction has also been examined separately by PublicAML. In its October 14 investigation, the service recorded token sales producing 14.93 ETH, then worth about $36,000, against the earlier roughly $86,000 token valuation. It also identified ZC tokens remaining in the exploit contract at the time it checked.
That analysis concerns the earlier Ethereum leg, not the entire later four-chain estimate. It does not reduce the expanded incident to a $36,000 loss. Rather, it illustrates why valuing tokens at a quoted price and measuring the proceeds of selling them can produce different numbers.
A sale into limited liquidity can realize less than the last quoted value of the whole position. Our liquidity explainer covers the distinction between a displayed price and the execution available for a particular quantity. Any final accounting should state its valuation times and method instead of combining incompatible measures.
A vesting schedule depends on the contract enforcing it
Vesting normally controls when allocated tokens become available. In a shared contract, several users' positions can depend on the same accounting. The important security question is whether each position's permitted withdrawal remains consistent with the tokens backing it.
PublicAML's account of the first transaction describes a sequence involving positions being opened, topped up, released and canceled. A schedule in an interface cannot itself prove that every such combination preserves the intended restriction. That requires examination of the contract and its actual execution paths.
The current evidence establishes an expanded reported incident and a response that remains under review. It does not establish a final recovery percentage, the identity of every attacker or the present safety of every affected pool. The next decisive documents are UNCX's consolidated findings and recovery terms, with transaction-level evidence showing which claims have been fulfilled.