DxSale hack — May 2026

On 29 May 2026 an attacker drained roughly $7.3 million from legacy liquidity-locker contracts operated by DxSale, a BNB Chain token-launch and liquidity-locking service, hitting more than 1,400 legacy liquidity-provider positions. Control of the locker came first. On-chain analyst Tahax found that DxSale's deployer had silently transferred ownership of the legacy locker around August 2025, roughly nine months earlier, with no public announcement, and that admin rights then moved through roughly 80 intermediate wallets before reaching the address that executed the drain. Security research firm DARKNAVY dates the final transferOwnership call to 26 May 2026 at 01:08:56 UTC, executed using EIP-7702-style delegated code, and names the vulnerable locker and the attacker account. Coinsult identified a privileged setFee mechanism, which let the attacker reduce the lock-modification fee to near zero, combined with a backdated lock configuration. The attacker then called unlockToken() repeatedly: the function transferred the stored LP amount without consuming the lock record, so the same lock index could be reused. DARKNAVY counted 667,465 unlock events across 1,362 transactions and 45 LP token contracts, with a single transaction calling the function 500 times against one LP token. The attacker-controlled address moved roughly $1.87 million worth of BNB into two consolidation wallets and on to multiple Binance deposit addresses; other proceeds were swapped to BNB and routed through bridge and mixer services. PeckShield and Coinsult flagged the drain, and DxSale posted a notice on its X account hours later confirming an exploit was under investigation, without publishing affected contracts or transaction detail. On-chain investigators, including the account Eyeonchain, have argued the trail points to insider involvement or a leaked team key, citing an August 2025 offer circulating on DxSale's Telegram channel to unlock old DxSale LP positions in exchange for a share of the proceeds. That claim is unproven, no charges have been reported, DARKNAVY traces the ownership chain to a previously legitimate owner address rather than to collusion, and DxSale has not addressed it.