DxSale exploit proof of concept
DxSale's deployer shifted the DxLocker ownership through 89 wallets over 269 days; the final owner called the privileged `DXLOCKERLP()` owner-only backdoor to drain all 1,400+ locked LP positions, roughly $7.3M total.
- Reported loss
- ~7.3M USD, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-28: Ownership Override Attack on DxSale”.
Analysis1 min read
DxSale's deployer secretly transferred the DxLocker owner's privilege through 89 wallets over 269 days. The final owner (the attacker) used the privileged DXLOCKERLP() owner-only backdoor function to drain all 1,400+ locked LP positions to itself.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state. The final transfer in the chain and the drain transactions are referenced; @tahax1 reported the incident. Total loss is approximately $7.3M USD across the locked LP positions.
What would have prevented it: a multisig with a public veto window for DXLOCKERLP(), or any transition path that requires a quorum of token holders rather than a single owner wallet. The chain of 89 wallets shows the pattern of slow key rotation that only becomes visible in retrospect; a contract pattern that makes ownership visible at every transition would catch this earlier.
Other exploits
- Gravity Bridge exploit analysis $5.4M
- DxSale exploit analysis $7.3M
- YSDAO exploit analysis 29 May 2026
- LegendaryMoneyMonNft exploit analysis 28 May 2026
- Joe Agent exploit analysis 27 May 2026
- SKP Token exploit analysis 26 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
