DxSale: legacy 2021 locker contracts drained across about 1,400 pools

What happened

• 29 May 2026, BNB Chain: about USD 7.3M from about 1,400 legacy liquidity locks. Per BlockSec, the attacker controlled the victim locker from 26 May, and the deployer account showed anomalous activity from 15 Apr.
• Root cause per BlockSec: three missing checks in unlockToken (an if instead of require on lock time, locked amount never zeroed, balance compared to the contract total instead of the caller’s allocation). The deployer account, which operated via EIP-7702 delegation, was also compromised and used to transfer locker ownership and change fees; BlockSec says that was not required for the drain but helped it. Rekt classes it as key leakage.
• Attribution: none.
• Response: newer DxSale contracts reported unaffected. Funds reportedly routed toward Binance deposit addresses.

Sources

• https://blocksec.com/blog/web3-security-dxsale-squidrouter-more
• https://cointelegraph.com/news/memecoin-platform-dxsale-drained-73m-1400-lps

This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.