DxSale Locker Exploit Drains $7.3 Million From BNB Chain

Overview

• Investigators reported Friday that attackers drained about $7.3 million in BNB from DxSale legacy locker contracts, impacting roughly 1,400 liquidity providers whose positions had been locked since as early as 2021.
• On‑chain analysis links the theft to a silent ownership transfer hundreds of days earlier that passed control through dozens of wallets before reaching the address that executed the withdrawals.
• Security firms say the exploit combined a hidden backdoor with a privileged function (reported as a ‘setFee’ mechanism) and manipulated lock timestamps so balances that should have stayed locked became withdrawable.
• Blockchain tracing shows roughly 2,958 BNB (about $1.87 million) moved into two primary wallets and that some funds were routed toward exchange deposit addresses after initial funding came from Bybit, which complicates recovery.
• The breach adds to a larger May wave of DeFi losses estimated at about $52 million and has prompted warnings from experts that automated and AI‑assisted tools are accelerating the discovery of subtle contract flaws in legacy infrastructure.