CryptoReal
CASE FILE — Jun 2, 2026

A Dormant Admin Key From 2021 Just Cost DxSale $7.3 Million

DR By Diego Ramos Jun 2, 2026 11 min read

DxSale's liquidity-locking product was never hacked in the conventional sense. Instead, a wallet that had quietly held administrative control over an old 2021 locker contract used that authority to unlock and empty it, taking roughly $7.3 million with it.

That locker had gone largely unmaintained for years, sitting on BNB Chain still holding LP tokens from projects launched during the 2021 memecoin cycle. At some point, control of it passed to someone who shouldn't have had it — the transfer itself was routed through more than 80 separate wallets to obscure who ended up holding the keys. Once that handoff occurred, the outcome was no longer in question; only the date was left open.

01How the Drain Unfolded

The attacker made their move on May 27, 2026. Leveraging the owner permissions they now controlled together with EIP-7702 batch delegation, they unlocked and swept more than 1,400 BNB Chain liquidity pools in one coordinated operation, zeroing out fees along the way. Tokens that project teams believed were locked, immutable, and safe under DxSale's custody instantly became withdrawable. From there, the proceeds moved through a series of intermediary wallets before landing in various Binance deposit addresses — and much of that movement happened before affected teams even knew anything was wrong.

DxSale itself said nothing for well over a day. Its first public acknowledgment came the following morning as a tweet: "We're aware of a recent exploit and liquidity drain. Investigation is underway. Stay tuned for updates." No transaction hashes. No list of impacted contracts. No mention of the additional $15.5 million still sitting in two other compromised lockers.

Those other two contracts — 0x81E0eF68 and 0x2D045410 — had also had ownership handed to the same attacker address, confirmed by an on-chain record showing the same destination wallet. Both remain compromised.

02Independent Researchers Filled In What DxSale Wouldn't

Tahax was first to flag the incident, publishing in the early hours of May 28 and then waiting roughly fifteen hours before anyone else picked it up. Tahax's early thread had already sketched out the shape of the attack: the ownership transfer itself, the roughly 80-hop chain used to launder the trail, and a 269-day gap between the moment the contract changed hands and the moment it was drained. Tahax also noted that the exploiter's wallet was brand new and funded via Bybit, floated the possibility that an undisclosed backdoor had sat in the contract with no public migration notice, and warned that tracing the funds was already getting difficult.

GoPlus Security followed roughly fifteen hours after Tahax's post with the most complete technical writeup of the incident — indicators of compromise, a step-by-step attack flow, dollar estimates across all four affected locker contracts, and a direct call for exposed projects to withdraw immediately. GoPlus pinned the confirmed loss at $7.3 million and warned that three additional locker contracts under the same attacker's control held an estimated $15.5 million still at risk.

Alaoui Capital weighed in early on May 29, summarizing the exploit — the aging 2021 locker, the abused admin key, the hidden backdoor — and closing with the observation that the DxSale team still hadn't responded and that they'd be watching for developments.

DxSale's actual response didn't arrive until the morning of May 29 — more than a full day after Tahax's initial post — repeating the same brief acknowledgment quoted above, still without hashes, contract lists, or any mention of the remaining exposure.

ExVul published its own technical breakdown later that day, and PeckShield followed with the clearest fund-flow figures: roughly 2,958 BNB, worth about $1.87 million, traced moving through two primary wallets en route to several Binance deposit addresses.

Perhaps the most significant supplementary detail came from eyeonchains, who resurfaced screenshots from August 2025 showing an individual advertising a paid LP-unlock service inside DxSale's own Telegram group. That person claimed insider access within the DxSale team that could unlock legacy LPs from pre-late-2021 project launches, charging a 20% fee on whatever was recovered — and, according to their own claims, had already recovered $200,000 and been paid $100,000 for it by the time the screenshots were taken. The only prerequisite was that someone from the original project's team still controlled the wallet used to raise funds on DxSale. eyeonchains' takeaway was that the backdoor enabling this may have existed for years, potentially traceable to a former DxSale insider who understood exactly how those locks could be bypassed.

SlowMist logged the event in its hacked-incident database under a category that leaves little room for interpretation: Private Key Leakage.

03A Contract Frozen in 2021, Governed by One Key

The drained locker contract was deployed in 2021, at the height of the BNB Chain memecoin frenzy, and was used by hundreds of token launches as a trust signal — proof that developers couldn't simply pull liquidity and disappear. The platform processed thousands of these locks during that period, then, like much of the infrastructure from that era, faded from active development while the assets inside it stayed put — with no further audits, no ongoing monitoring, and no migration plan put in place over the following years. Many of the original project owners had moved on entirely, leaving a contract holding tens of millions of dollars sitting idle, guarded only by whoever held its single administrative key.

That single key was the real vulnerability. The contract used Solidity's standard Ownable pattern, including a transferOwnership function that does precisely what its name implies — hands full administrative rights to any address instantly, with no waiting period, no second signature required, and no requirement to disclose the change on-chain. Whoever held that key could pull LP tokens straight out of the locker, overriding any time-based lock that project teams assumed was protecting their funds. In practice, nothing about these locks was ever truly immutable — they were an administrative setting that could be toggled by whoever controlled the owner address.

Whether the key was stolen from its rightful holder or whether the person controlling it acted from inside the organization remains unknown publicly. What's clear is the mechanism: legitimate admin functionality, used by someone who had no legitimate claim to use it — which is essentially how SlowMist categorized it.

On May 26, 2026, the wallet that had held the original owner rights called transferOwnership on the primary locker, handing full control to the attacker's address. That same original-owner wallet had already sent ownership of two more locker contracts to the identical destination. The on-chain record of this transfer predates the actual drain by two days — the attacker had already funded the wallet via Bybit and simply waited.

Original owner address: 0x47BAcf935066b802EAA0067eC14AB035B24eB78b Attacker address: 0xC4574DDEF299e7E563971e200433e592EeaaFA69

The batch-transaction capability from EIP-7702, introduced with the Pectra upgrade, was what allowed the attacker to hit over 1,400 pools efficiently in one pass. Notably, DxSale's May 30 statement blamed the incident on "BSC's recent atomic tx feature" — a reference to that same EIP-7702 capability — without acknowledging that ownership of the contract had been transferred months earlier.

This isn't the first time this exact class of weakness had been raised. Back in June 2023, while the project was briefly operating under the DxApps rebrand before reverting to the DxSale name, security firm Decurity disclosed a critical flaw in this same locker contract that could have let an attacker drain roughly $5.2 million in locked LP tokens at the time. The remedy chosen was simply raising locking fees enough to make the exploit economically unappealing — a deterrent, not a fix to the underlying design. Decurity explicitly flagged that the contract owners themselves would still be able to drain the funds at will, and the developers reportedly acknowledged and accepted that risk rather than address it.

04Tracing the Funds

According to on-chain analysis, the attacker's wallet received an initial 104 BNB — about $67,000 — from Bybit roughly 20 hours ahead of the main drain, apparently to cover gas and confirm everything was ready before execution. The wallet was created specifically for this operation.

Attacker wallet: 0xC4574DDEF299e7E563971e200433e592EeaaFA69

Sums referenced in this case file

EIP-7702 delegator contracts used in the exploit:

From there, stolen funds passed through a set of aggregation/relay wallets before reaching Binance:

Intermediate wallets:

Notable transactions:

PeckShield tracked the funds into multiple Binance deposit addresses, and GoPlus Security urged affected teams to submit on-chain evidence to exchanges and request account freezes, pointing out that the Bybit-funded seed transaction gives investigators a KYC-linked lead. It's not publicly known whether either exchange has taken action.

05The Two Contracts Still Sitting Exposed

As of publication, the status of the three known locker contracts breaks down as follows:

Fully drained primary locker: 0xEb3a9C56d963b971d320f889bE2fb8B59853e449

Still-compromised contracts:

Both had ownership handed to the attacker by the same original-owner wallet, 0x47BAcf935066b802EAA0067eC14AB035B24eB78b, and neither has been touched as of this writing. Total remaining exposure across the two is $15.5 million — separate from the $7.3 million already confirmed lost from the primary, now-empty locker. The attacker still holds the keys to both and simply hasn't acted on them yet.

06DxSale's Second Statement Raises More Questions Than It Answers

The primary locker — deployed in 2021 — was never replaced or upgraded; it just kept holding legacy LP tokens while the rest of the platform evolved. DxSale rolled out a new v3.3 locker architecture in March 2022, but the older v1 contract that got drained was left in place, still fully loaded with assets.

DxSale's second public statement, posted May 30, read: "We've isolated the issue to v1 lockers (launched in 2021). The exploit stems from BSC's recent atomic tx feature. Rest assured: 100% of lockers (v2+) are safe & Certik-audited."

Three things stand out here. First, pinning the exploit on EIP-7702's atomic transaction capability sidesteps the actual cause — that feature only enabled the scale of the drain; the unprotected owner key is what enabled the attack itself. Second, confirming that only v1 lockers were hit says nothing about the additional $15.5 million sitting in the two other compromised contracts. Third, pointing to a CertiK audit of the v2+ contracts offers little to the 1,400-plus projects whose v1-locked liquidity is already gone — there has been no post-mortem, no compensation plan, and no published list of affected projects.

07A Prior Connection to SafeMoon

DxSale has a documented history with SafeMoon, one of the more infamous projects from the 2021 BNB Chain boom. SafeMoon ran its fair launch on DxSale and kept its LP locked in DxLocker for four years — the same infrastructure now at the center of this exploit. SafeMoon's team was later charged criminally by the SEC over fraud and an unregistered securities offering, and GoPlus noted the historical link between the two platforms in its incident writeup.

08What the Timeline Suggests

The gap between the ownership transfer and the drain — 269 days — doesn't fit the profile of an opportunistic outsider who stumbled onto a bug. Neither does the deliberate pacing: the pre-funded gas wallet, the multi-stage execution, the 80-hop laundering chain built out ahead of time. None of it looks improvised. Whether that points to insider knowledge or simply a patient, well-planned external operation is still an open question.

That question gets harder to dismiss in light of the Telegram screenshots eyeonchains surfaced — dated August 2025, nearly nine months before the drain — showing someone openly selling access to an insider-connected LP-unlocking service, on the condition that the requesting party still controlled the original fundraising wallet, for a 20% cut of whatever got recovered. It's not confirmed whether that service's operator is connected to this exploit, but it is confirmed that someone with real knowledge of how to bypass these locks was selling that knowledge publicly nearly a year before this attack occurred at scale.

Which loops back to Decurity's 2023 disclosure: three years before the drain, they flagged the same underlying flaw, were compensated $500 for it, and stated plainly that the fee-based patch left the owner-key exposure completely unaddressed. Three years later, whoever controlled that key used it. Whether that person obtained it through compromise or had held it the entire time is a question DxSale has done nothing to help answer. The wallet that executed the transferOwnership call is visible on-chain to anyone — who actually controls it is not.

09The Bigger Picture

DxSale's stated purpose from the start was preventing rug pulls, positioning itself as the first decentralized launchpad to offer locked liquidity. That reputation is now $7.3 million lighter, and the underlying flaw is structural: the promise that locked liquidity stays locked was never actually enforced by code — it was enforced by whoever happened to control the owner key, which amounted to no enforcement at all once that key moved to the wrong hands.

Decurity flagged this exact risk in 2023, got DxSale to implement a partial fix, and was paid $500 for the disclosure — while stating clearly that the core exposure remained. Three years of silence followed. Then $7.3 million left the primary locker, emptying it completely, while two more contracts holding a confirmed $15.5 million combined — 0x81E0eF68 and 0x2D045410 — remain under the attacker's control as of publication, with no visible sign DxSale has moved to revoke that access.

DxSale's follow-up on May 30 placed the blame on BSC's atomic transaction feature, without a post-mortem, a compensation plan, or any explanation of who transferred the ownership key or why. The broader lesson isn't novel — timelocks, multisig requirements, and ownership monitoring are well-documented, freely available safeguards that would have made this specific attack impossible to carry out. None of them were in place. A contract holding tens of millions of dollars in other people's assets answered to a single key with no restrictions on how or when it could be transferred, and that arrangement held — until it didn't.

Whether DxSale eventually publishes a post-mortem, a recovery plan, or a law enforcement referral remains to be seen. For now, the on-chain record is the only complete account available, and what it shows is a nine-month setup, a controlled and deliberate execution, and a team that has had very little to say about any of it.

Sources and reporting referenced throughout: PeckShield, GoPlus Security, DxSale, Tahax, Alaoui Capital, ExVul, eyeonchains, SlowMist, Decurity, DappRadar, SEC, and SafeMoon's contract repository.

Admin PrivilegesDxSale
Investigation alerts

Get new scam files the moment we publish them — usually 2–3 emails a week.

Enter a valid email address.

No spam, unsubscribe anytime. We never sell your data. Crypto assets are volatile and high-risk; nothing here is financial advice.

You're on the list. Watch your inbox for the next scam file.