DxSale Exploit Drains $7.3 Million From 1,400 BNB Chain Liquidity Pools as Investigators Raise Insider Access Questions

An attacker withdrew $7.3 million on May 29, 2026, from liquidity pools linked to more than 1,400 BNB Chain projects that used DxSale’s liquidity-locking infrastructure during the 2021 crypto market cycle.

DxSale is a token launchpad and liquidity-locking platform on BNB Chain that was widely used during the 2021 crypto market cycle to help projects raise funds and lock liquidity before launching tokens to the public.

The affected liquidity positions were primarily tied to dormant projects whose funds had remained locked for years after development activity ceased. According to on-chain researchers, the withdrawals may be linked to a compromise involving DxSale's legacy locker contracts.

The incident has drawn attention across the crypto industry due to the number of affected projects and allegations that the activity may have been prepared months before the first funds were withdrawn.

Tahax First Raises Alarm Over $7.3 Million DxSale LP Drain

The incident was first brought to public attention by on-chain researcher Tahax, who published a thread on X on May 28 alleging that $7.3 million had been withdrawn from liquidity pools locked through DxSale's legacy infrastructure.

DxSale was the largest liquidity locker on BNB Chain during the 2021 retail cycle, with major projects such as SafeMoon using its locker contracts. According to his analysis, many of those liquidity positions remained untouched for years after the underlying projects became inactive.

The scale of the incident was significant because DxSale served as a trust layer for thousands of token launches during the previous market cycle. While many of the projects later disappeared, the locked liquidity remained inside the platform's legacy contracts.

Tahax claimed the attack can be traced back to 269 days ago, when ownership of a DxSale locker contract was transferred to a new wallet. He said the contract was unverified and that a backdoor remained accessible after the transfer of ownership.

According to Tahax, ownership was subsequently moved through more than 80 wallet transactions over several months before reaching address 0xC4574DDEF299e7E563971e200433e592EeaaFA69 two days before the withdrawals began.

The final wallet was a newly created address funded from Bybit, and funds were routed through AnySwapBot before the draining activity began.

At the time of his post, Tahax found that more than 1,400 liquidity pools had already been affected and that roughly $7.3 million had been extracted from BNB Chain liquidity positions. He further claimed that the proceeds were being mixed through services that made the final destination of the funds difficult to trace.

Eye Raises Insider Access Questions and Traces Funds to Exchange Wallets

Several hours after Tahax published his findings, on-chain investigator Eye shared additional information that introduced a new angle to the story.

In a post on May 28, Eye revealed that he had previously been contacted in August 2025 by a user asking him to investigate DxSale. Eye attached to the post a screenshot he received during a Telegram conversation in which an individual claimed to have direct contacts within the DxSale team who could unlock liquidity positions for projects launched before late 2021.

The messages described a service that allegedly helped recover old liquidity pools in exchange for a 20% fee. According to the screenshots, the only requirement was that someone from the original project team still controlled the wallet used to raise funds through DxSale.

Eye said the screenshots drew renewed attention after the recent withdrawals began, raising the possibility that access to old liquidity positions may have existed long before the alleged exploit became public.

Later the same day, Eye published a thread expanding on Tahax's findings and outlining what he described as potential links between the draining activity and parties with knowledge of DxSale's infrastructure.

Referencing Tahax's timeline of a silent ownership transfer, more than 80 wallet hops, and over 1,400 affected liquidity pools, Eye said his analysis of the wallet used during the withdrawals revealed what he believed were "strong indicators" of a direct connection to the DxSale team. However, he did not provide definitive proof linking any specific individual to the activity.

Eye focused much of his analysis on fund movement through wallet addresses and found an alleged connection between one of the wallets used in the attack and the DXSale team wallet.

Eye called on Binance to freeze any funds connected to the incident pending further investigation, as the assets ultimately belong to investors whose projects originally locked liquidity through DxSale.

Jeremy Outlines Alleged Exploit Mechanism

After the initial findings from Tahax and Eye, on-chain expert Jeremy, an X account with over 280,000 followers, shared additional details about how the liquidity pools have been drained.

According to Jeremy, the attacker gained control of a legacy DxSale locker contract 269 days before the withdrawals began and remained inactive for months before moving ownership through additional wallets. He alleged that a custom drainer contract was later deployed to modify the locker settings, lower fees, and backdate unlock timestamps to January 1, 1970.

Jeremy claimed the changes caused the contracts to treat long-locked liquidity positions as already expired, allowing funds to be withdrawn. “Once the contract thought every lock had already expired, the withdrawals began,” he wrote.

He estimated that approximately $1.74 million had already been withdrawn, while another $2.91 million remained in vulnerable positions. Jeremy also noted that DxSale was used by more than 11,000 projects during the 2021 market cycle, leaving large amounts of dormant liquidity locked in legacy contracts years after many of the projects became inactive.

DxSale Confirms Investigation Is Underway

In a post on X published 24 hours after the incident was first revealed, the platform said it was aware of a "recent exploit and liquidity drain" and confirmed that an investigation was underway. The team did not provide additional details about the cause of the incident, the amount affected, or whether any funds may be recoverable.