Incident Overview: Zombie Contracts Become Cash Machines
In the past 40 days, hackers exploited five deprecated but still-active smart contracts (so-called 'zombie contracts') to drain approximately $17 million. The affected contracts belong to DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect. All share the same vulnerability: project teams stopped maintaining the contracts but left behind funds, admin keys, or callable functions, turning them into easy targets.
Root Cause: Incomplete Decommissioning
Security analysts attribute the breaches to incomplete retirement processes. Many DeFi projects, after upgrading or migrating to new contracts, fail to withdraw locked assets, revoke owner/admin keys, or disable critical functions from old contracts. This allows attackers to directly call original interfaces or exploit lingering bugs. Notably, Raydium Legacy AMM's liquidity pool, even if no longer actively traded, contained leftover LP tokens that were redeemable for underlying assets.
Affected Projects and Loss Distribution
On-chain forensic data reveals the following approximate losses: DxSale $4.2M (unswept token sale proceeds), TrustedVolumes $3.5M (oracle service fees left in escrow), Huma Finance V1 $3.0M (collateral assets in lending pools), Raydium Legacy AMM $4.8M (old LP tokens swapped out), and Aztec Connect $1.5M (wrapped assets in bridge contract). Total: ~$17M.
This is not the first such incident, but the cluster underscores a systemic gap in contract lifecycle management. To protect users, projects should implement a standardized decommissioning checklist: withdraw all remaining funds, revoke administrative privileges, pause or destroy contracts, remove front-end references, and conduct periodic audits of archived contracts. The community must treat old contracts as potential liabilities until they are fully neutered.