A vesting balance and its share records came apart. Check what left the Ethereum manager, then inspect the later return as its own transaction.
UNCX attributes its Smart Token Vesting V2 incident to public vesting actions that corrupted share accounting, allowing withdrawals beyond the tokens supplied. Its report covers four networks. This written case checks one Ethereum X-token drain and a later transfer described by the project as a return.
UNCX incident report, version 2.0, 15 October 2026 ↗Etherscan shows the drain succeeded in block 26,191,920 at 16:24:59 UTC on 14 October. We retained its 410 decoded logs and summed all 164 X-token Transfer events: manager outflows minus inflows equal 150,000,000 X. A separate successful transaction in block 26,205,564 on 16 October transfers 82,143,476.362922687 X to an address different from the vesting manager. That transfer alone does not prove holder reimbursement.
Inspect the drain and its 410 decoded logs ↗Success in block 26,191,920. Sum the manager’s incoming and outgoing X transfers; repeated cyclic volume is not net outflow.
Success in block 26,205,564 at 14:02:11 UTC. The single Transfer log records 82,143,476.362922687 X. UNCX identifies this transfer as a return.
The Ethereum manager cited in the report and observed in the drain’s token-transfer logs. It is not the recipient of the later return transfer.
The token emitting the Transfer events. Etherscan lists nine decimals; the return log’s raw integer is 82,143,476,362,922,687.
Open the Ethereum transaction in Forensia and check the chain and source coverage. Match the X-token emitter before comparing amounts. Use nine decimals, rather than assuming every ERC-20 uses eighteen.
The captured drain logs show 1,969,405,576.056468528 X leaving the manager and 1,819,405,576.056468528 X entering it. Their difference is 150,000,000 X. These totals are from this one transaction, not an incident-wide loss or a dollar valuation.
The later log transfers X from 0xC70f00CD…A8b80ea0 to 0x32f0eB06…E58c4cb. The full addresses are linked in the return record. Keep the project’s return attribution separate from what the log proves. Recipient control, distributions to holders and other chains need their own evidence.