Locked liquidity means the tokens that represent a project's share of a trading pool (LP tokens) are held by a smart contract that won't release them before a set date. While the lock holds, whoever created the pool can't withdraw its assets and leave holders with a token nobody can sell. The lock only works if the locker contract is sound. On 29 May 2026, more than 1,400 pools that had been locked through old DxSale locker contracts on BNB Chain were drained, for about $7.3 million in total.
The newest case: old DxSale lockers drained (May 2026)
Cointelegraph reported on 29 May 2026 that about $7.3 million in BNB Chain liquidity was taken from around 1,400 liquidity providers. The blockchain security firm PeckShield flagged the attacker's fund movements. The Defiant described the target as "a dormant launchpad contract from 2021" that was emptied "through a quiet ownership transfer and a one-wei fee reset".
The full mechanism has not been confirmed:
- Analyst Tahax, quoted by Cointelegraph, said the DxSale deployer had transferred ownership of the locker to a new wallet 269 days earlier without an official migration announcement. He said about 80 further ownership transfers followed before control reached the wallet that made the withdrawals.
- The security platform Coinsult, also quoted by Cointelegraph, said: "A privileged setFee plus a backdated lock turned 'locked' deposits into a withdrawable balance."
- Cointelegraph said it had asked DxSale for comment. No DxSale statement had been published in the reports we checked.
The point for anyone who relies on locks: the projects themselves did not pull their liquidity, and the funds were lost anyway. Cointelegraph's follow-up on 9 June 2026 put it this way: "a lock is only as strong as the system enforcing it."
How a liquidity lock works
A decentralised exchange that uses liquidity pools holds two assets in a smart contract, for example a new token and a stablecoin, and lets anyone swap between them. When a team creates the pool, it deposits both assets and receives LP tokens, which act as the claim on the pool's contents. Whoever holds the LP tokens can redeem them and withdraw the assets.
To lock liquidity, the team sends those LP tokens to a locker contract with an unlock date. Until that date, nobody can redeem them through the locker. That includes the team. Trading against the pool carries on as usual, because the lock only covers withdrawals.
In concentrated-liquidity pools, a liquidity position is an NFT, not a fungible token. OpenZeppelin's audit of UNCX's locker for such pools (report published 8 February 2024) describes "first converting the market liquidity position into an NFT" and then moving that NFT into the locking contract. While the position is locked, the owner can still collect trading fees but can't remove the liquidity until the lock expires.
When a lock expires, the LP tokens go back to whoever deposited them. That party can then withdraw the liquidity, lock it again or move it.
Locking is different from burning. Burned LP tokens are sent to an address nobody controls, so the liquidity can never be withdrawn. That is permanent, and it also rules out any later migration of the pool.
Why locks exist: the data on rug pulls
- Memecoin losses (2024): Merkle Science, a crypto intelligence firm, found that more than $500 million was lost to memecoin rug pulls and scams in 2024 (CoinDesk, 11 February 2025). The report does not say what share of that came from liquidity removal.
- Solana launches (study published May 2025): Solidus Labs analysed 388,000 liquidity pools on a major Solana decentralised exchange. It found that about 93% showed signs of "soft rug pulls", "where liquidity was abruptly withdrawn, severely impacting token prices". For the study, a liquidity sweep meant a burn that removed at least 90% of a pool's liquidity. Solidus Labs reported that 98.6% of tokens created on a Solana token launchpad between January 2024 and March 2025 showed pump-and-dump behaviour.
- A false lock claim (SEC, 16 January 2025): The US Securities and Exchange Commission alleged that the promoters of the GME token said publicly that liquidity was "locked". It also alleged that engineer Eric Zhu kept LP tokens unlocked at an address he alone controlled and "used them to engage in a rug pull", taking about $553,000. Zhu neither admitted nor denied the allegations and agreed to pay $672,992 in disgorgement and prejudgment interest plus a $150,000 penalty, subject to court approval.
The SEC case shows why a project saying its liquidity is locked proves nothing. Only a lock you can see on-chain counts.
Is this pool's liquidity really locked?
Answer what you find on-chain, step by step, to see which risk a token's liquidity lock still leaves open.
Open the LP token's holder list. Where does most of the LP supply sit?
- An ordinary wallet → Not locked
- A burn address → next question
- A known locker contract → next question
On the locker's page or contract, is all of the LP supply locked, or only part of it?
- All of it → next question
- Only part of it → Partly locked
When does the lock end?
- Within days or weeks → Lock ends soon
- Much later than that → next question
Is the locker contract verified and open source, with no owner power to change fees, unlock terms or ownership?
- No, or I can't tell → The locker itself is the risk
- Yes → next question
Can the token contract mint new supply, pause transfers, blacklist holders or change the sell tax?
- Yes, at least one of these → Token controls still open
- No → This lock checks out, but keep going
LP tokens in an ordinary wallet are not locked: the holder can withdraw the pool's assets at any time, whatever the project says.
A partial lock leaves the rest of the LP supply free to withdraw.
A lock that ends in days or weeks gives little protection: when it expires, the LP tokens go back to the depositor, who can withdraw the liquidity.
If the locker's owner can change fees, unlock terms or ownership, or the contract can't be checked, the lock is only as strong as that contract. Admin powers like these were at the centre of the May 2026 locker drain.
The pool may be locked or burned, but insiders could mint and sell new tokens or stop holders from selling through owner controls.
Check every other pool for the token, since liquidity added to a new, unlocked pool isn't covered, and check how much supply insiders hold unlocked. Confirm any scanner result on-chain.
This walks through the on-chain checks the article describes; it cannot inspect a contract for you, find hidden flaws in an audited locker, or tell you whether a token is worth buying.
How to check whether liquidity is really locked
1. Find the pool and its LP token
Look up the token's contract address on a block explorer for its chain, such as Etherscan, BscScan or Solscan. Then find the main trading pool and the token that represents shares in it.
2. See who holds the LP tokens
Open the LP token's holder list. Most of the supply should sit in one of these places:
- a known locker contract, which you then check in step 3;
- a burn address, which means the liquidity is permanently locked;
- an ordinary wallet, which means it is not locked and the holder can withdraw at any time.
If several pools exist, check each one. Liquidity added to a new, unlocked pool after launch is not covered by the original lock.
3. Check the lock itself
On the locker's own page or contract, confirm:
- Amount: what share of the LP supply is locked. A partial lock leaves the rest free to withdraw.
- Unlock date: a lock that ends in days or weeks gives little protection.
- Who controls the locker: is the contract verified and open source? Can the owner change fees, unlock terms or ownership? The DxSale case turned on exactly these admin powers.
4. Use a scanner, then check its output
Token-security APIs return these checks in machine-readable form. In GoPlus Security's documented fields, for example:
lp_holderslists the top 10 LP holders, with anis_lockedflag;locked_detailgives anend_timefor when locked tokens unlock;- other fields flag
is_mintable,hidden_owner,can_take_back_ownership,transfer_pausable,is_blacklisted,slippage_modifiable(whether the owner can change trading tax) andis_honeypot.
Treat scanner results as a starting point and confirm them on-chain.
What a lock does not protect against
A liquidity lock blocks one thing: the LP holder withdrawing the pool. It leaves these risks in place:
- The locker itself. In October 2022, an attacker exploited a flaw in Team Finance's audited version 2 to version 3 migration function. Reported losses were $14.5 million (CoinDesk) and about $15.8 million in tokens (The Block, 27 October 2022). According to CoinDesk, the attacker later returned about $7 million. The DxSale case in May 2026 is the second example in this article.
- Minting. If the token contract can mint new supply, insiders can create tokens and sell them into the locked pool.
- Owner controls over trading. Pausable transfers, blacklists and adjustable sell taxes can stop holders from selling while the pool itself is untouched.
- Unlocked team tokens. A locked pool says nothing about how much of the supply insiders hold and can sell. Token vesting is a separate mechanism from a liquidity lock.
- Expiry. When the lock ends, the liquidity can be withdrawn. Check the unlock date, not only whether a lock exists.
Liquidity lockers: what the providers state
- Team Finance says more than 40,000 projects use it, that its lock contract "has held up to $6.5B in total value locked" (no date given), that it supports 28+ blockchains, and that its contracts were audited by CertiK, Hacken and BailSec. These are the company's own figures. It is also the locker exploited in October 2022.
- UNCX Network's locker for concentrated-liquidity pools was audited by OpenZeppelin in January 2024 (report published 8 February 2024). The audit found 24 issues, including 1 critical and 3 high-severity issues, all of which were resolved. Of the 24, 14 were resolved and 1 partially resolved.
A clean audit at one point in time does not make a locker safe. Team Finance's migration function had been audited, and the DxSale contracts had been dormant for years before they were drained.
Frequently asked questions
Is locked liquidity the same as burned liquidity?
No. Locked LP tokens come back to the depositor when the lock ends. Burned LP tokens can never be recovered.
Can a project still rug pull with locked liquidity?
Yes. Insiders can sell unlocked supply, mint new tokens or use owner functions that block selling. A flaw in the locker can also release the liquidity early, as in the DxSale case.
Can I still trade a token whose liquidity is locked?
Yes. The lock restricts withdrawals by the LP holder, not swaps against the pool.
What is the difference between token locking and liquidity locking?
Token locking or vesting limits when insiders can sell their own tokens. Liquidity locking limits when the pool's assets can be withdrawn.
Limitations: the DxSale mechanism is based on early reports and analyst comments, with no published post-mortem from DxSale. Locker statistics are the providers' own figures. This article is not investment advice.
