Verify a decision

{"actor":"system:backfill","investigation_id":"25233318-e0fb-4689-95b7-364e14f55b1e","kind":"publish","page_slug":"dxsale","published_at":"2026-06-04T17:07:09.233Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"DxSale","sections":[{"content":"On May 28, 2026, an attacker exploited DxSale's legacy BNB Chain liquidity locker contracts, draining approximately $7.3 million from over 1,400 LP positions that had been locked since as far back as 2021. The exploit was first flagged publicly by blockchain security firm PeckShield. The primary attacker-controlled wallet identified by investigators was 0xC4574DDEF299e7E563971e200433e592EeaaFA69. Approximately 2,958 BNB (valued at roughly $1.87 million at time of exploit) was routed through two primary wallets before being deposited across multiple Binance addresses. Additional BNB totaling approximately 3,400 BNB (roughly $1.2 million) was also sent to Binance deposit addresses, with remaining funds routed through multichain mixers to further obscure the trail. Approximately 20 hours before the main drain, the attacker's wallet received 104 BNB from Bybit, a pattern consistent with pre-exploit staging. Among the notably affected pools were liquidity positions associated with the original SafeMoon project, with analysts reporting approximately $1.74 million in SafeMoon LP value withdrawn. The DxSale team issued no public statement across any official communication channels following the incident.","heading":"May 2026 Exploit: Legacy Locker Drain","severity":"critical","sources":[{"credibility":2,"name":"Hackers Drain $7.3M From DxSale's Old BNB Chain Liquidity Lockers — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/29/hackers-drain-7-3m-from-dxsales-old-bnb-chain-liquidity-lockers/"},{"credibility":2,"name":"DxSale exploit drains $7.3M in BNB through hidden contract backdoor — crypto.news","type":"news_article","url":"https://crypto.news/dxsale-exploit-drains-7-3m-in-bnb-through-hidden-contract-backdoor/"},{"credibility":2,"name":"DxSale Hacked for $7.3M: Insider Team Attack Suspected — Bitcoin Foundation","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/dxsale-exploit/"},{"credibility":3,"name":"DxSale Drained of $7.3M as Backdoor Hits 2021-Era BNB Lockers — SpendNode","type":"news_article","url":"https://www.spendnode.io/blog/dxsale-7-3m-legacy-locker-exploit-backdoor-may-2026/"}]},{"content":"Web3 auditing firm Coinsult traced the drain to the exploitation of two privileged administrative functions embedded in the legacy locker smart contracts. First, the attacker invoked a privileged setFee function to reduce the locking fee to 1 wei — the smallest possible unit of BNB — eliminating any cost barrier to modifying locked positions. Second, the attacker set the lock expiration timestamp to 68 seconds after the Unix epoch (effectively January 1, 1970), a backdated value that caused the contract to treat every locked position as fully expired and immediately withdrawable, regardless of the actual lock dates set by depositors years prior. Coinsult's assessment was: 'A privileged setFee plus a backdated lock turned locked deposits into a withdrawable balance.' The attacker then used custom contracts to execute batch withdrawals across hundreds of liquidity pools in rapid succession. The targeted contracts were unverified legacy contracts predating DxSale's subsequent security improvements. A separate 2023 vulnerability disclosure by security firm Decurity had previously highlighted architectural risks in DxSale's locking mechanism that enabled unauthorized unlocking of LP tokens, suggesting the underlying class of vulnerability was known to the security research community prior to this exploit.","heading":"Technical Attack Mechanism","severity":"critical","sources":[{"credibility":2,"name":"DxSale Hack Drains $7.3 Million On BNB Chain, Impacts 1,400 — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/dxsale-hack-drains-7-3-million-on-bnb-chain/"},{"credibility":3,"name":"DxSale Drained of $7.3M as Backdoor Hits 2021-Era BNB Lockers — SpendNode","type":"news_article","url":"https://www.spendnode.io/blog/dxsale-7-3m-legacy-locker-exploit-backdoor-may-2026/"},{"credibility":2,"name":"Hackers Drain $7.3M From DxSale's Old BNB Chain Liquidity Lockers — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/29/hackers-drain-7-3m-from-dxsales-old-bnb-chain-liquidity-lockers/"}]},{"content":"On-chain investigators, including analyst Tahax and the Eyeonchain analytics team, identified multiple indicators consistent with insider involvement by a current or former DxSale team member. Approximately 269 days before the May 28, 2026 drain — placing the initial event around early August 2025 — ownership of the legacy locker contract was silently transferred from the DxSale deployer wallet to a new wallet without any public announcement or migration notice to affected users or token teams. Ownership then passed through approximately 80 intermediate wallet addresses in a chain of transfers designed to obscure the trail before arriving at the final attacker address 0xC4574DDEF299e7E563971e200433e592EeaaFA69. Blockchain analysis identified a historical connection between the attacker's address and developer wallets, with the address allegedly having previously been used to channel funds to the main DxSale contract. Separately, screenshots circulating in the community showed that in August 2025, an individual allegedly advertised a service on DxSale's Telegram channel claiming insider team access and offering to unlock legacy LP positions from projects launched before late 2021 in exchange for a 20% fee — a service that, in retrospect, may have been an early phase of the eventual drain operation. Eyeonchain investigators concluded the exploit involved 'someone with insider-level access,' possibly a former team member. These findings remain alleged and unconfirmed by law enforcement or court proceedings as of June 2026.","heading":"Alleged Insider Involvement","severity":"critical","sources":[{"credibility":2,"name":"DxSale hit by $7.3 mln exploit as claims of insider involvement rise — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/dxsale-hit-by-7-3-mln-exploit-as-claims-of-insider-involvement-rise-details/"},{"credibility":2,"name":"DxSale Hacked for $7.3M: Insider Team Attack Suspected — Bitcoin Foundation","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/dxsale-exploit/"},{"credibility":3,"name":"DxSale Liquidity Drain Hits 1400 BNB Chain Pools for $7.3M — OurCryptoTalk","type":"news_article","url":"https://ourcryptotalk.com/news/dxsale-liquidity-drain-bnb-chain-pools"}]},{"content":"DxSale's official documentation lists three founders — identified only by the single names Dennis, Hash, and Raphael — reachable via @dxsale.network email addresses. No surnames, LinkedIn profiles, or independently verifiable real-world identities for these individuals have been published. The team's documentation itself warned users that unsolicited direct messages from anyone other than designated sales representatives were likely from scammers, and instructed users to verify usernames against the primary Telegram channel. The original team was described as comprising five members at launch (four engineers and one product manager) with claimed prior experience at S&P 500 companies in North America, but this has not been independently verified. The pseudonymous or partially-anonymous structure of the founding team is a material risk factor, particularly given the alleged insider involvement in the May 2026 exploit, as it significantly limits accountability and legal recourse for affected users.","heading":"Team Anonymity and Disclosure","severity":"high","sources":[{"credibility":1,"name":"Team (Contact Us) — DxSale Official Docs","type":"official","url":"https://docs.dxsale.network/what-is-dxsale/team-contact-us"},{"credibility":3,"name":"Recap of DxSale AMA With Bsc.News Community — Medium","type":"other","url":"https://medium.com/@promiselisha/recap-of-dxsale-ama-with-bsc-news-community-216e91805b7e"}]},{"content":"DxSale launched in August 2020 on the Ethereum network, positioning itself as the first end-to-end autonomous launchpad combining token presales with on-chain liquidity locking in a single flow. The platform expanded to BNB Chain (then Binance Smart Chain) in January 2021, to Polygon in February 2021, and subsequently to Avalanche, Fantom, Harmony, OKX Chain, xDai, and HECO networks in May 2021. Version 2 of the platform launched in March 2021 and Version 3 in September 2021. In January 2023, the platform released Version 4 and rebranded from DxSale to DX App (accessible at dx.app), encompassing four core products: DxSale (presales and fair launches), DxMint (no-code token creation), DxLock (liquidity and token locking with vesting schedules), and DxDrop (multi-wallet token distribution). The SALE governance token was launched on Ethereum in August 2020 and reached an all-time high price of approximately $2.08 on September 3, 2021. The legacy BNB Chain liquidity locker contracts targeted in the May 2026 exploit were remnants of the 2021-era infrastructure that were not migrated or deprecated when the platform rebranded.","heading":"Platform History and Rebranding","severity":"medium","sources":[{"credibility":1,"name":"History of DxSale.Network — Official DxSale Docs","type":"official","url":"https://docs.dxsale.network/what-is-dxsale/history-of-dxsale.network"},{"credibility":2,"name":"DxSale.Network (SALE) — CoinMarketCap","type":"other","url":"https://coinmarketcap.com/currencies/dxsale-network/"}]},{"content":"In 2023, security firm Decurity disclosed a vulnerability in a Dx Protocol locker contract on BNB Chain that enabled unauthorized unlocking of LP tokens — an architectural class of risk directly analogous to the mechanism exploited in May 2026. This prior disclosure was publicly reported in multiple outlets covering the 2026 incident and suggests that the underlying locker architecture had known weaknesses that the DxSale team did not remediate in the legacy contracts. The 2023 disclosure recommended migration to more secure, audited locking solutions, advice that remained unheeded for the legacy 2021-era contracts. The combination of known prior vulnerabilities, unannounced administrative ownership changes, and the complete absence of any official team response following the May 2026 exploit represents a significant and compounding pattern of security negligence.","heading":"Prior Security Warnings","severity":"high","sources":[{"credibility":2,"name":"Hackers Drain $7.3M From DxSale's Old BNB Chain Liquidity Lockers — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/29/hackers-drain-7-3m-from-dxsales-old-bnb-chain-liquidity-lockers/"},{"credibility":3,"name":"DxSale Drained of $7.3M as Backdoor Hits 2021-Era BNB Lockers — SpendNode","type":"news_article","url":"https://www.spendnode.io/blog/dxsale-7-3m-legacy-locker-exploit-backdoor-may-2026/"}]},{"content":"Following the drain, stolen funds were converted to BNB and routed through two primary attacker-controlled wallets before being deposited across multiple Binance deposit addresses. Separate portions of the proceeds were also routed through multichain.org mixers to further obscure the trail. The use of centralized exchange deposit addresses (Binance) in the fund flow creates a theoretical avenue for law enforcement or exchange cooperation to freeze or trace assets, though no such action had been publicly announced as of June 4, 2026. No recovery fund, compensation scheme, or formal law enforcement referral had been announced by DxSale or any third party as of that date. Community members advised affected users to verify their positions on BscScan and withdraw any still-accessible funds, and to migrate remaining locked assets to audited third-party locking solutions. The prospects for individual recovery are assessed as low given the mixing activity and the absence of any identified, legally actionable party.","heading":"Fund Tracing and Recovery Prospects","severity":"high","sources":[{"credibility":2,"name":"DxSale Hacked for $7.3M: Insider Team Attack Suspected — Bitcoin Foundation","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/dxsale-exploit/"},{"credibility":3,"name":"Can DxSale Users Recover Funds After $7.3M LP Loss? — CoinGabbar","type":"news_article","url":"https://www.coingabbar.com/en/crypto-currency-news/dxsale-73m-drain-from-liquidity-pools-on-bnb-chain"},{"credibility":2,"name":"DxSale hit by $7.3 mln exploit as claims of insider involvement rise — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/dxsale-hit-by-7-3-mln-exploit-as-claims-of-insider-involvement-rise-details/"}]},{"content":"The DxSale exploit contributed to an estimated $52 million in total DeFi losses recorded for May 2026, according to data cited by multiple outlets. This figure contrasts with April 2026, which saw approximately $634 million in crypto hack losses — cited as the highest monthly total in over a year per DefiLlama data. Year-to-date crypto hack losses as of late May 2026 were reported to have exceeded $17 billion. The DxSale incident is particularly notable within this context because the exploited contracts dated to 2021, illustrating the enduring risk posed by unmigrated or undeprecated legacy smart contract infrastructure across DeFi protocols that subsequently rebrand or shift product focus.","heading":"Broader DeFi Context","severity":"medium","sources":[{"credibility":2,"name":"DxSale loses $7.3M in BNB Chain liquidity providers (LPs) hack — Invezz","type":"news_article","url":"https://invezz.com/news/2026/05/29/dxsale-loses-7-3m-in-bnb-chain-liquidity-providers-lps-hack/"},{"credibility":2,"name":"DxSale Hack Drains $7.3 Million On BNB Chain, Impacts 1,400 — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/dxsale-hack-drains-7-3-million-on-bnb-chain/"}]}],"sources_used":[{"credibility":2,"name":"Hackers Drain $7.3M From DxSale's Old BNB Chain Liquidity Lockers — CryptoTimes","type":"news_article","url":"https://www.cryptotimes.io/2026/05/29/hackers-drain-7-3m-from-dxsales-old-bnb-chain-liquidity-lockers/"},{"credibility":2,"name":"DxSale exploit drains $7.3M in BNB through hidden contract backdoor — crypto.news","type":"news_article","url":"https://crypto.news/dxsale-exploit-drains-7-3m-in-bnb-through-hidden-contract-backdoor/"},{"credibility":2,"name":"DxSale Hacked for $7.3M: Insider Team Attack Suspected — Bitcoin Foundation","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/dxsale-exploit/"},{"credibility":2,"name":"DxSale loses $7.3M in BNB Chain liquidity providers (LPs) hack — Invezz","type":"news_article","url":"https://invezz.com/news/2026/05/29/dxsale-loses-7-3m-in-bnb-chain-liquidity-providers-lps-hack/"},{"credibility":2,"name":"DxSale hit by $7.3 mln exploit as claims of insider involvement rise — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/dxsale-hit-by-7-3-mln-exploit-as-claims-of-insider-involvement-rise-details/"},{"credibility":3,"name":"DxSale Drained of $7.3M as Backdoor Hits 2021-Era BNB Lockers — SpendNode","type":"news_article","url":"https://www.spendnode.io/blog/dxsale-7-3m-legacy-locker-exploit-backdoor-may-2026/"},{"credibility":2,"name":"DxSale Hack Drains $7.3 Million On BNB Chain, Impacts 1,400 — TronWeekly","type":"news_article","url":"https://www.tronweekly.com/dxsale-hack-drains-7-3-million-on-bnb-chain/"},{"credibility":3,"name":"Can DxSale Users Recover Funds After $7.3M LP Loss? — CoinGabbar","type":"news_article","url":"https://www.coingabbar.com/en/crypto-currency-news/dxsale-73m-drain-from-liquidity-pools-on-bnb-chain"},{"credibility":3,"name":"DxSale Liquidity Drain Hits 1400 BNB Chain Pools for $7.3M — OurCryptoTalk","type":"news_article","url":"https://ourcryptotalk.com/news/dxsale-liquidity-drain-bnb-chain-pools"},{"credibility":1,"name":"History of DxSale.Network — Official DxSale Docs","type":"official","url":"https://docs.dxsale.network/what-is-dxsale/history-of-dxsale.network"},{"credibility":1,"name":"Team (Contact Us) — Official DxSale Docs","type":"official","url":"https://docs.dxsale.network/what-is-dxsale/team-contact-us"},{"credibility":2,"name":"DxSale.Network (SALE) — CoinMarketCap","type":"other","url":"https://coinmarketcap.com/currencies/dxsale-network/"},{"credibility":2,"name":"DxSale Hack Drains $7.3 Million From 1,400 BNB Chain Investors — CoinPaper","type":"news_article","url":"https://coinpaper.com/17358/dx-sale-hack-drains-7-3-million-from-1-400-bnb-chain-investors"}],"summary":"DxSale is a decentralized token launchpad and liquidity-locking platform launched in August 2020, originally on Ethereum and later expanded to BNB Chain and other EVM networks. On May 28, 2026, a hidden backdoor in legacy BNB Chain liquidity locker contracts was exploited to drain approximately $7.3 million from more than 1,400 LP positions locked as far back as 2021. On-chain analysis identified a 269-day pre-exploit ownership transfer chain passing through approximately 80 wallets, with indicators strongly suggesting insider involvement by a current or former team member.","timeline":[{"date":"2020-08-01","event":"DxSale launched on Ethereum with an IDO; team comprised five members.","source":"History of DxSale.Network — Official DxSale Docs","source_url":"https://docs.dxsale.network/what-is-dxsale/history-of-dxsale.network"},{"date":"2020-11-01","event":"DxSale.app and Dx.app launched, described as the first truly decentralized launchpad listing on a DEX with locked liquidity.","source":"History of DxSale.Network — Official DxSale Docs","source_url":"https://docs.dxsale.network/what-is-dxsale/history-of-dxsale.network"},{"date":"2021-01-01","event":"DxSale expanded to BNB Chain (Binance Smart Chain), deploying the legacy liquidity locker contracts later targeted in the 2026 exploit.","source":"History of DxSale.Network — Official DxSale Docs","source_url":"https://docs.dxsale.network/what-is-dxsale/history-of-dxsale.network"},{"date":"2021-09-03","event":"SALE token reached its all-time high price of approximately $2.08.","source":"DxSale.Network (SALE) — CoinMarketCap","source_url":"https://coinmarketcap.com/currencies/dxsale-network/"},{"date":"2023-01-01","event":"DxSale released Version 4 and rebranded to DX App; legacy BNB Chain locker contracts were not migrated or deprecated.","source":"History of DxSale.Network — Official DxSale Docs","source_url":"https://docs.dxsale.network/what-is-dxsale/history-of-dxsale.network"},{"date":"2023-01-01","event":"Security firm Decurity disclosed a vulnerability in a Dx Protocol locker contract enabling unauthorized unlocking of LP tokens — a prior warning of the class of risk exploited in 2026.","source":"Hackers Drain $7.3M From DxSale's Old BNB Chain Liquidity Lockers — CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/29/hackers-drain-7-3m-from-dxsales-old-bnb-chain-liquidity-lockers/"},{"date":"2025-08-03","event":"Approximately 269 days before the May 28, 2026 exploit, the DxSale deployer allegedly silently transferred ownership of the legacy locker contract to a new wallet without public announcement; ownership subsequently passed through approximately 80 intermediate wallets.","source":"DxSale Hacked for $7.3M: Insider Team Attack Suspected — Bitcoin Foundation","source_url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/dxsale-exploit/"},{"date":"2025-08-01","event":"An individual allegedly advertised a service on DxSale's Telegram channel claiming insider access to unlock legacy LP positions from pre-2021 projects for a 20% fee — cited by investigators as a potential early-phase indicator of the exploit.","source":"DxSale hit by $7.3 mln exploit as claims of insider involvement rise — AMBCrypto","source_url":"https://ambcrypto.com/dxsale-hit-by-7-3-mln-exploit-as-claims-of-insider-involvement-rise-details/"},{"date":"2026-05-28","event":"Approximately 20 hours before the main drain, 104 BNB was transferred from Bybit to the primary attacker wallet 0xC4574DDEF299e7E563971e200433e592EeaaFA69.","source":"Hackers Drain $7.3M From DxSale's Old BNB Chain Liquidity Lockers — CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/29/hackers-drain-7-3m-from-dxsales-old-bnb-chain-liquidity-lockers/"},{"date":"2026-05-28","event":"Attacker invoked privileged setFee function to set locking fee to 1 wei and backdated all lock expiration timestamps to 68 seconds after Unix epoch; batch withdrawals across 1,400+ LP positions began, draining approximately $7.3 million in BNB.","source":"DxSale exploit drains $7.3M in BNB through hidden contract backdoor — crypto.news","source_url":"https://crypto.news/dxsale-exploit-drains-7-3m-in-bnb-through-hidden-contract-backdoor/"},{"date":"2026-05-29","event":"PeckShield and Coinsult published on-chain analysis of the exploit; multiple crypto news outlets reported the incident; DxSale team issued no public statement.","source":"DxSale Hacked for $7.3M: Insider Team Attack Suspected — Bitcoin Foundation","source_url":"https://bitcoinfoundation.org/news/crimes-and-fraud-news/dxsale-exploit/"}]},"v":1}