DxSale Liquidity Drain Hits 1,400 BNB Chain Pools for $7.3M

Steady attention without excessive speculation.

The affected pools date back to 2021. DxSale served as the default liquidity locker for thousands of BNB Chain token launches during that era. One of the most notable victims is the original SAFEMOON liquidity pool.

As of May 28, 2026, approximately $1.74 million has already been withdrawn. An estimated $2.91 million remains at risk.

How the DxSale Liquidity Drain Unfolded

This was not a flash exploit. The attack began approximately 269 days before the drain. Around late August or early September 2025, ownership of the legacy locker contract was silently transferred.

According to analysis by @Param_eth, the ownership passed through roughly 80 intermediate wallets before landing at the final address: 0xC457…FA69. That wallet received funding through Bybit and bridge activity.

Once in control, the attacker deployed a custom drainer contract. This contract manipulated the locker’s internal parameters in a specific sequence. It set lock fees to 1 wei, essentially zero. Then it created new locks on already-locked LP positions. It backdated the unlock timestamps to January 1, 1970, known as Unix epoch zero.

That made every affected pool immediately withdrawable. The drainer looped “Unlock Token” calls across all 1,400 pools and extracted the LP tokens.

The attacker swapped the drained funds to BNB through PancakeSwap. From there, the proceeds moved through bridge and mixer services resembling @anyswapbot, making them untraceable.

DxSale has not issued any public statement about the incident. The team’s last known activity on social media predates the drain.

Why DxSale Was Trusted

During the 2021 BSC boom, DxSale (dx.app) was one of the largest decentralized launchpad and liquidity locker platforms on BNB Chain. Projects used its locker to show that their LP tokens were safely locked. That served as a trust signal for retail investors.

Hundreds of millions of dollars sat inside DxSale’s contracts at its peak. As @Tahax1 noted, “In 2021, if you launched a token on BNB Chain, you locked your LP with DxSale. It was the trust layer for retail.”

That trust is now broken. Allegedly, the same infrastructure designed to prevent rug pulls has enabled one instead.

An Unverified Contract Holding Millions

A critical detail stands out in this incident. The legacy locker contract was never source-verified on BscScan. That means its code was not publicly readable, and no external auditor or user could inspect its admin permissions.

For a contract that held millions in locked LP tokens over several years, this represents a significant oversight. The unverified status shielded the ownership transfer from casual on-chain monitoring.

This is not unique to DxSale. DeFi remains filled with old, unaudited contracts that still hold real value. No one actively monitors most of them. This DxSale liquidity drain illustrates what happens when legacy infrastructure meets a patient attacker.

Prior Security Issues

DxSale’s locker architecture has faced scrutiny before. In 2023, security firm Decurity disclosed a vulnerability in a related Dx Protocol locker contract. That flaw also enabled unauthorized unlocking of LP tokens.

The 2023 disclosure established a precedent. It showed that the DxSale locker design had exploitable logic. It also raised questions about whether other contract versions shared the same flaw.

Community Reaction and Attribution

The story spread rapidly on X after @Tahax1’s initial thread. That thread accumulated more than 34,000 views within hours. The dominant reaction was shock and anger.

“The biggest trusted liquidity locker protocol just allegedly stole $7.3 million,” wrote @Param_eth in a corroborating analysis.

Community member @0xsadikbaba attributed the DxSale liquidity drain to a known figure dubbed the “Hash Again Scammer.” He stated, “This was not some random hacker. The backdoor existed. They knew it. They used it.” That attribution remains unverified.

Some replies dismissed the story as “fake news,” but those claims gained no traction. Multiple independent analysts confirmed consistent on-chain wallet activity matching the described exploit pattern.

What Remains Unknown

Several key questions are still unanswered. The exact identity of the attacker is unclear. The attacker could be an insider with old admin keys. Alternatively, an external actor may have compromised the deployer wallet.

It is also unknown whether every project that locked liquidity on DxSale is affected, or only specific legacy pools. The final destination of all drained funds after mixing remains untraceable, according to investigators.

No law enforcement agency, exchange, or regulatory body has issued any statement or freeze order related to the incident. No major security firms like PeckShield or SlowMist have published independent analysis yet.

What This Means for DeFi Users

The DxSale liquidity drain is a stark reminder. “Locked liquidity” is only as safe as the contract holding it. When that contract has an unverified codebase and a transferable admin key, the lock is an illusion.

Users who relied on DxSale’s locker during the 2021 BSC era had no way to detect this. The trust was based on reputation, not on code verification.

For projects and investors still using legacy locker contracts on any chain, this incident underscores a clear lesson. Verify the contract source code. Monitor ownership changes. And understand that a lock is only as strong as the admin controls behind it.

This is not financial advice. Always conduct your own research before making investment decisions.