Incident Overview
Security researchers have reported that a hacker successfully drained nearly $17 million from five DeFi protocols over a 40-day period by exploiting abandoned smart contracts. These contracts were considered legacy—no longer actively maintained by their respective teams—yet they remained “alive” on the blockchain, still holding funds, administrative permissions, or callable entry points that the attacker could leverage.
Root Cause: Security Risks of Abandoned Contracts
Abandoned smart contracts refer to old versions of contracts that projects fail to fully disable or revoke after upgrading or migrating to newer versions. In this incident, all five protocols shared a common vulnerability: their deprecated contracts either contained unwithdrawn assets, still retained admin keys, or had outstanding token approvals that allowed external calls. The hacker discovered these “sleeping” contracts through on-chain data analysis and proceeded to withdraw funds or invoke privileged functions, transferring assets out before the projects could react. Because the contracts were no longer monitored, the theft went unnoticed for a prolonged period.
Security Recommendations for Projects
This attack serves as a stark reminder for all DeFi projects to thoroughly clean up legacy contract environments after deploying upgrades. Critical steps include: revoking all admin keys from old contracts, withdrawing any remaining funds to a secure address, canceling unnecessary token approvals, and, if the contract code permits, executing a self-destruct function to remove the contract from the chain entirely. Regular audits of all deployed contracts—especially those marked as deprecated—should be performed to detect and patch potential vulnerabilities. Investors are also advised to check project announcements and avoid interacting with unverified legacy contract addresses.