Attack Overview: $17M in 40 Days
Blockchain security monitoring shows that over the past 40 days, attackers exploited five deprecated but still functional smart contracts to steal approximately $17 million in cryptocurrency. These so-called 'zombie contracts' – abandoned yet still live on-chain – have become easy targets for hackers.
Projects Affected and Attack Vectors
The compromised contracts belong to: DxSale (decentralized token sale platform), TrustedVolumes (volume proof protocol), Huma Finance V1 (credit protocol), Raydium Legacy AMM (outdated automated market maker on Solana), and Aztec Connect (privacy bridge). Attackers called residual permission functions or drained leftover liquidity pools that were never withdrawn. None of the contracts had proper freeze or kill switches, allowing the attackers to profit without bypassing any new security measures.
Security Recommendations
This incident underscores the need for rigorous contract decommissioning procedures: withdraw all funds, revoke admin keys, and disable all callable functions. Security teams advise periodic audits of legacy contracts and the use of pause or self-destruct mechanisms to fully neutralize retired code.