UNCX on Ethereum: Five Token Sales Yielded 21.155 ETH—Not All Inflows Were Proceeds

A UNCX vesting-pool transaction on Ethereum moved five tokens into an execution route on 14 October 2026. Four were converted into ETH that afternoon. The fifth, ZC, remained in the executor until the following morning, when a withdrawal and a separate sale completed the selected route.

Three roles make that sequence easier to follow. The shared vesting pool held tokens for scheduled releases. The initiating wallet submitted the transaction. The executor was a contract created during that execution, which received tokens and later forwarded them for conversion. These role names describe addresses in the records, not identified people.

The confirmed path is shared vesting pool → executor contract → token conversions → the initiating wallet. The two conversion sessions paid that wallet 21.155286011908665958 ETH in total. A separate 0.29 ETH return from the executor was not another token sale. Understanding that distinction matters more here than attaching one large dollar estimate to every transfer.

This is a bounded Ethereum investigation, not a reconstruction of every UNCX-related drain. The account below separates transaction records, arithmetic and external reporting, then follows the transitions in time order.

Before the numbers: who does what?

Vesting is a schedule for releasing tokens over time. A shared vesting contract can hold tokens for many positions. Here, “pool” means the address whose token balances changed in the selected transaction; it does not mean that every position holder has been identified. A net outflow means recorded outgoing tokens minus incoming tokens within that transaction—not the sum of all transfers displayed by an explorer.

The initiating wallet submitted the seed transaction. It called an entry contract, which created an executor: a contract that carried out further interactions and received tokens. The executor is a distinct address, not a second name for the wallet. A funding address supplied ETH beforehand. These are roles in the records, not names for people or proof that one operator controlled all of them.

Three findings guide the investigation. The pool’s five token net outflows reconcile to the executor and other net recipients. The fifth conversion happened on the following day, so stopping on 14 October misses a material receipt. Finally, the sale receipts, returned execution capital and later wallet balance answer different questions. The chronology below explains why.

Start Figure 1 at the pool and follow the top arrow to the executor, then down to the initiating wallet receiving tokens for conversion. Read the lower boxes as the two conversion sessions: their arrows point back toward the wallet because it received the final ETH. They are not additional recipients to add to the wallet.

Figure 1. Solid arrows indicate asset direction or grouped conversion paths, not transaction calls, ownership, quantity scale or elapsed time. All amounts shown are rounded to six decimals. The public receipts and exact tables govern the quantities.

The overview shows a route with a pause, rather than a single immediate cash-out. It also stops at the receiving wallet: a sale on a decentralized route does not itself establish a deposit with an exchange. The first chronological question is how the initiating wallet was funded.

14 October, 14:47–15:15 UTC: funding arrives before execution

The funding address sent 0.1, 0.9 and 2.5 ETH to the initiating wallet at 14:47:35, 14:56:59 and 15:15:35 UTC, respectively. Together these transfers supplied 3.5 ETH before the seed transaction. ETH is Ethereum’s native asset; it can pay transaction fees as well as contract payments. First funding; second funding; third funding.

15:49:59 UTC: five token balances fall in one seed transaction

The successful seed transaction sits in block 26,191,745. Its receipt contains 136 logs, including 64 ERC-20 Transfer events. An ERC-20 token keeps its own ownership ledger; a Transfer event records a movement in that ledger. Several movements can occur inside one transaction, including borrowed tokens going in and back out. Seed transaction and receipt.

To avoid counting borrowed principal twice, this review summed the raw integer amounts in the transfer events by token and address. Token decimals translate those integers into readable units: 18 decimal places for four tokens, and nine for PAAL. For every token, the pool’s net outflow equals the sum of the positive net receipts at the executor and the other recipients.

The difference between the two columns is not an unexplained second theft. The receipt records net amounts at a fee recipient and, for three tokens, other counterparties in the execution. Those quantities are preserved separately in the appendix. Do not add the executor’s receipt to the pool’s outflow: they are two views of the same movement.

This reconciliation establishes token movements. It does not reconstruct every vesting position or prove the vulnerability’s cause. The incident-time implementation and storage were not replayed here, so the exact accounting defect remains unconfirmed by this analysis. The evidence supports the selected outflow route more directly than it supports a complete root-cause claim.

16:41–17:01 UTC: returned capital and four sales

At 16:41:11, the executor returned exactly 0.29 ETH to the initiating wallet. The seed had supplied 0.8 ETH; ten 0.05 ETH payments and one 0.01 ETH payment account for 0.51 ETH, leaving 0.29 ETH. The exact conservation and later return support reading it as unused execution capital. The complete executor history and code semantics were not independently replayed, so this interpretation remains narrower than a full contract audit. Capital return.

Three minutes later, the first selected token sale paid ETH to the wallet. Four conversions followed in order: pepeCoin at 16:44:35, EDGEN at 16:56:47, LO0P at 16:58:59 and PAAL at 17:01:11. A swap route can wrap ETH into WETH and unwrap it again. WETH is a token representation of ETH; counting each internal hand-off would inflate the sale receipt. Here only the final ETH receipt at the initiating wallet is counted.

The four receipts sum to 14.636607026266583654 ETH, before costs. The LO0P sale was submitted by a different address, even though ETH reached the initiating wallet. A third-party transaction submitter can execute an order for a recipient. That fact does not identify a co-attacker, and the third party’s transaction fee must not be subtracted from the initiating wallet’s funds without checking who paid it. LO0P receipt.

At 17:09:35, after these four sales, 3.5 ETH went back to the funding address. That return connects the two addresses financially, but does not establish a real-world identity, common control or an ultimate cash-out destination. It also does not mean that the sale receipts disappear from the ledger: it is a later movement of ETH, not a negative token sale. Return transaction.

15 October, 07:28–07:35 UTC: ZC completes the selected conversion route

At 07:28:35 the executor sent 9,055,847.637887682268154756 ZC to the initiating wallet. This was a token withdrawal, not yet a sale. At 07:35:11—six minutes and 36 seconds later—a separate successful transaction converted that amount and paid 6.518678985642082304 ETH to the same wallet. ZC withdrawal; ZC sale.

The sale used LI.FI routing and included a token fee of 4,527.923818943841134077 ZC. The remaining 9,051,319.714068738427020679 ZC moved onward to the router. The route ultimately unwrapped WETH and delivered ETH through routing contracts to the wallet. These intermediary transfers explain how the conversion completed; they are not extra sale proceeds. The trace displayed 150 of 204 call frames, so the original explorer transfer records supplement the quantity check rather than constituting a complete execution replay.

Stopping the account on 14 October would therefore omit more than 6.5 ETH of selected sale receipts. Conversely, adding the 0.29 ETH capital return would overstate those receipts. Figure 2 separates the two accounting categories before showing the later balance snapshot.

Figure 2. Read the green sale box and amber capital box separately. The connecting arrows identify receipt categories reaching one wallet; they do not instruct the reader to add them as profit. The lower gray panel is a later balance observation. Amounts are rounded to six decimals.

The five sale receipts total exactly 21.155286011908665958 ETH. This is a gross conversion receipt, not net profit, a dollar loss or the wallet’s entire balance. Gas, execution payments, starting funds and other transfers need their own accounting. One unsolicited incoming wei and a successful zero-EDGEN transfer are excluded from sale proceeds. The remaining question is where the observed ETH stood at a defined cutoff.

17 October: a fixed-block snapshot, not a final destination

At block 26,210,180, timestamped 05:27:59 UTC, the initiating wallet held 20.237222755363802454 ETH and the funding address held 7.459202396392388 ETH. These were read at the same historical block through Ethereum JSON-RPC, not inferred by subtracting a selection of transfers. The block hash is preserved in the appendix. Cutoff block; RPC endpoint documentation.

A balance belongs to an address, not to one incident. The funding address’s balance in particular is not an additional UNCX loss. Within the bounded native-ETH follow-up, no custodial-exchange deposit, bridge exit or mixer deposit was identified from these two addresses. Provider coverage and labels are incomplete; this is not proof that no outside-scope movement exists or that the funds can be recovered.

One account detail also deserves care. The initiating wallet’s code at the cutoff is an EIP-7702 delegation marker pointing to a separate implementation. EIP-7702 lets an account authorize delegated code execution. A nonce is an account’s sequential counter; it helps distinguish an authorization or transaction from an earlier one. The ZC sale’s authorization used nonce 25, while its outer transaction used nonce 24; an authorization can increment the authority’s nonce inside that transaction. It is not evidence of a separate later transaction, a compromised key or a specific operator. Sale authorization; EIP-7702 specification.

What connects the route—and what remains open

The strongest connections are direct: the executor was created inside the seed execution, token events reconcile its receipts, the next-day ZC withdrawal names the same sender and recipient roles, and the five sale receipts pay the initiating wallet. These are transaction-level links. The funding relationship is a different level of evidence: it establishes value moving between two addresses, not common ownership. Similar patterns or shared service labels cannot fill that gap.

Blockaid’s broader alert reported approximately $1.49 million across four chains and 11 drains including copycats and MEV activity—automated attempts to extract value from transaction execution or ordering. That is external incident context, not this report’s verified net loss. This review does not independently aggregate BNB Chain, Base or Robinhood activity, price every token at the incident time, or assign every affected vesting position to a victim. Blockaid update; published transaction list.

The transfer-event arithmetic was independently reconstructed from Etherscan receipts. SentinelTX supplied call traces and bounded address follow-up; fixed-block balance and code reads were checked separately through Ethereum RPC. These are complementary evidence sources, not interchangeable confirmations. The selected record is reproducible, but neither the root cause nor a complete multichain victim ledger has been established by this analysis.

Response points specific to this case

The first response question is which vesting positions were affected. Investigators need the incident-time position state and decoded deposit/withdrawal events, not only the shared pool’s balance change. That would connect the reconciled token outflows to individual claims and avoid confusing fee or lending-counterparty receipts with executor gains.

The second is why those movements were accepted. Replaying the seed against the implementation and storage at block 26,191,745 would test the reported accounting mechanism and identify which invariant failed. A current implementation page or a matching exploit pattern is not an adequate substitute.

The third is whether the receiving wallet later crosses into a service with a verifiable destination record. Any new exchange, bridge or mixer label needs the actual transaction, chain, asset and time attached. A historical funding source is not an onward route for proceeds created later. Until such a record is linked, the report should stop at the observed wallets rather than draw a speculative cash-out arrow.

The defensible conclusion is therefore specific: five tokens left the shared pool in the selected Ethereum transaction, and five later conversions paid 21.155286011908665958 ETH to the initiating wallet across two days. The 0.29 ETH executor return is separate capital, and the 17 October balance is a snapshot. Those distinctions preserve what the evidence explains without turning unanswered questions into findings.

Evidence appendix: exact quantities and identifiers

All addresses below are on Ethereum. Wallet and contract links open address-detail pages; transaction links open transaction-detail pages. Values are unrounded unless explicitly labeled otherwise. Raw token quantities were summed as integers, using each token’s recorded decimal precision.

EDGEN: seed-receipt reconciliation

ZC: seed-receipt reconciliation

pepeCoin: seed-receipt reconciliation

LO0P: seed-receipt reconciliation

PAAL: seed-receipt reconciliation

Execution and routing addresses

Chronological transaction register (UTC, 2026)

Cutoff and counting notes

The five-sale total excludes the 0.29 ETH capital return, the unsolicited wei, repeated internal route legs and gas. No net-profit or dollar-loss total is asserted. The selected pool-net figures do not establish per-position losses. Findings reflect the stated cutoff and scope, not a live assurance about later funds.