DxSale (Legacy Liquidity Locker) — Ownership-Override Drain of 1,400+ LPs (Suspected Insider Backdoor)

Timeline: Around 28-29 May 2026, an attacker drained about $7.3M across more than 1,400 legacy liquidity-provider positions that had been locked in DxSale's BNB Chain liquidity locker since the 2021 memecoin era. On-chain analysts (Tahax, eyeonchain) documented that the DxSale deployer had silently transferred ownership of the locker contract to a new wallet roughly 269 days earlier and routed it through about 80 wallets for obfuscation, consolidating into 0xC4574DDE...aaFA69, which was funded with 104 BNB from Bybit about 20 hours before the drain. A custom drainer contract (0xc2efbd94...4718, unverified, Solidity 0.8.33) executed the attack: it set the fee to ~1 wei, backdated unlock timestamps (effectively to 1970), then batch-withdrew LP tokens from 1,400+ pools. About 2,958 BNB (~$1.87M) was routed to two main wallets and into Binance deposit addresses, where funds are considered likely to be frozen, though no official freeze was announced. PeckShield flagged the incident on the morning of 29 May; Coinsult and Tahax published analyses; DxSale was silent at the time of reporting. The drain bears strong insider-backdoor signals -- a years-old backdoor, the obfuscation chain, the pre-funding, and prior Telegram chatter (from August 2025) offering 'internal access to unlock old DxSale LPs' -- but insider attribution is a single-source allegation (eyeonchain) and has NOT been confirmed by any tier-1 security firm. Recovery: 0% (potential Binance freeze pending).