DxSale exploit analysis

A dormant DxSale liquidity locker from 2021 was drained of about $7.3 million across more than 1,400 BNB Chain pools in late May 2026. The attacker first took control of the locker contract via a series of ownership transfers that passed through roughly 89 wallets over nine months, according to on-chain investigator Tahax. Once the locker was theirs, Blockonomi reported, the contract was set up so that unlocking liquidity required only a one-wei fee, and unlock timestamps could be rewritten to match the moment of the call. Pools that had sat untouched for years were emptied in batches.

What the locker did

DxSale was widely used during the 2021 BNB Chain token boom. Projects locked their LP tokens with the platform to give holders some assurance that liquidity could not be pulled. The locker was administered by an owner key, with a transferOwnership pattern that any holder of that key could call. There was no on-chain time-lock and no public registry of who held the key. That is the design that made the eventual drain possible: the contract could not be paused, and once a single key changed hands, the previous owner had no way to revoke the privilege.

Movement of the funds

Investigators traced 2,958 BNB (around $1.87 million at the time) from the primary attacker address to two main wallets, with the rest of the haul split into smaller sums. Funds then moved through AnySwap and other routers, eventually landing in a series of Binance deposit addresses. The Defiant's follow-up framed the attack as part of a longer pattern of admin-key drains on BNB Chain legacy infrastructure.

Where it sits in the corpus

The DxSale case is the third in a short sequence of legacy-contract drains in 2026 that share the same root cause: an old admin key, left live in a deprecated contract that no one controls. Aztec Connect was hit twice in three days using the same pattern, and Raydium's deprecated AMM V3 program lost $1.34 million to a similar LP-mint flaw. All three reinforce the same lesson that the corpus keeps returning to: "deprecated" in DeFi often means "immutable, with a stale admin key still attached."