{"id":"dxsale-legacy-locker-theft-may-2026","category":"breach","status":"closed","title":"DxSale legacy v1 liquidity lockers on BNB Chain drained of about US$7.3 million","tldr":"DxSale's old 2021 v1 liquidity lockers on BNB Chain were drained of about US$7.3M across 1,400+ pools after ownership passed to an attacker. No recovery or compensation confirmed. Projects with tokens locked in v1 should check their lock and contact DxSale.","summary":"Between 26 and 28 May 2026, an attacker drained about US$7.3 million of liquidity tokens from more than 1,400 pools locked in DxSale's original 2021 v1 locker contract on BNB Chain. Rekt reports that the address that owned the contract passed ownership to the attacker on 26 May. The contract had no delay or multi-person approval on such a change. BlockSec adds that weak checks in the contract's unlock function also let a small lock draw from the shared pool. Sources disagree on whether the owner takeover was essential, and on whether the drain happened on 27 or 28 May. DxSale said the issue is limited to v1 lockers and that v2 and later are unaffected. It blamed BNB Chain's atomic-transaction feature and did not mention the ownership transfer. PeckShield traced about US$1.87 million to Binance deposit addresses. As of 2 June, Rekt reported no confirmed recovery, compensation plan or arrests, and about US$15.5 million in two other lockers still under the attacker's ownership. I found nothing newer.","action":"Nothing to update. If you or a company you advise locked tokens or liquidity through DxSale, check whether the lock is the 2021 v1 locker and ask DxSale or the project team. Never connect a wallet to messages offering to recover your funds for a fee.","product":"DxSale v1 liquidity locker contract (BNB Chain)","audience":"work","severity":"high","patch":"none","exploited":true,"cves":[],"tags":["dxsale","bnb-chain","crypto","liquidity-locker","private-key","eip-7702","defi","theft"],"affected":["DxSale v1 liquidity locker contract (2021) on BNB Chain"],"fixed":[],"matches":[],"sources":[{"kind":"news","title":"DxSale - Rekt","url":"https://rekt.news/dxsale-rekt","by":"Rekt","date":"2026-06-02"},{"kind":"post","title":"DxSale Releases Incident Clarification: v2 And Later Liquidity Lock Contracts Remain Unaffected","url":"https://onekey.so/blog/ecosystem/dxsale-releases-incident-clarification-v2-and-later-liquidity-lock-contracts-remain-unaffected-20260531045105/","by":"OneKey","date":"2026-05-31"},{"kind":"research","title":"Web3 security: DxSale, SquidRouter and more","url":"https://blocksec.com/blog/web3-security-dxsale-squidrouter-more","by":"BlockSec","date":"2026-06-03"},{"kind":"news","title":"Old DxSale lockers drained for $7.3M across 1,400 BNB Chain pools","url":"https://thedefiant.io/news/hacks/old-dxsale-lockers-drained-for-7-3m-across-1-400-bnb-chain-pools-as-owner-privil","by":"The Defiant","date":"2026-05-29"}],"started":"2026-05-28","closed":"2026-06-03","created":"2026-11-03T22:05:06.015Z","updated":"2026-11-03T22:05:06.015Z","cve_notes":[],"timeline":[{"at":"2026-06-03","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"BlockSec published an analysis. It said weak checks in the locker's unlock function let a small lock pull from the shared pool. It said the owner takeover was not required but made the attack more efficient.","url":"https://blocksec.com/blog/web3-security-dxsale-squidrouter-more","by":"BlockSec","patch":null},{"at":"2026-06-02","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"Rekt reported no confirmed recovery and no compensation plan. It said about US$15.5 million in two other lockers was still under the attacker's ownership but not yet drained. PeckShield had traced about 2,958 BNB (US$1.87 million) to Binance deposit addresses.","url":"https://rekt.news/dxsale-rekt","by":"Rekt","patch":"na"},{"at":"2026-05-30","added":"2026-11-03T22:00:26.134Z","kind":"vendor-revised","text":"DxSale said the problem was limited to its early v1 locker and that v2 and later lockers were unaffected. It blamed a clash with BNB Chain's newer atomic-transaction feature, and did not mention the ownership transfer.","url":"https://onekey.so/blog/ecosystem/dxsale-releases-incident-clarification-v2-and-later-liquidity-lock-contracts-remain-unaffected-20260531045105/","by":"OneKey","patch":null},{"at":"2026-05-29","added":"2026-11-03T22:00:26.134Z","kind":"other","text":"DxSale's first public statement said only that it was aware of an exploit and a liquidity drain and was investigating. It gave no list of affected contracts.","url":"https://rekt.news/dxsale-rekt","by":"Rekt","patch":null},{"at":"2026-05-27","added":"2026-11-03T22:00:26.134Z","kind":"wider-attacks","text":"Rekt says the attacker used owner powers and EIP-7702 batch delegation to drain more than 1,400 liquidity pools, about US$7.3 million, and set fees to zero. BlockSec dates the drain to 28 May, so the exact day is disputed.","url":"https://rekt.news/dxsale-rekt","by":"Rekt","patch":null},{"at":"2026-05-26","added":"2026-11-03T22:00:26.134Z","kind":"disclosed","text":"The address that owned DxSale's 2021 v1 locker contract on BNB Chain passed ownership to a new attacker-controlled address, with no delay or second approval needed. Two other lockers were reportedly transferred to the same address.","url":"https://rekt.news/dxsale-rekt","by":"Rekt","patch":null}],"url":"https://hard.fyi/live/dxsale-legacy-locker-theft-may-2026/","json":"https://hard.fyi/api/live?id=dxsale-legacy-locker-theft-may-2026"}