Incident Overview: 40 Days, 5 Contracts, $17 Million
On-chain security monitoring reveals that over the past 40 days, attackers leveraged five deprecated smart contracts that remain active on the blockchain to siphon nearly $17 million. Although these contracts were officially abandoned by their respective projects, they still contain residual assets, admin keys, or external call functions, turning them into lucrative targets.
What Are Zombie Contracts and Why Do They Drain Funds?
Zombie contracts are smart contracts that are no longer maintained but still hold value or permissions on-chain. Common scenarios include: incomplete migration from V1 to V2, unwithdrawn liquidity pools, lost or unrecovered private keys, and unrevoked allowances. Attackers scan old contract code to find still-valid withdrawal functions or proxy call interfaces, then directly drain balances or perform reentrancy attacks.
Affected Projects in Detail
- DxSale: A token sale launchpad whose deprecated contracts still contained substantial undisbursed funds.
- TrustedVolumes: An on-chain data verification service; an old permission control flaw was exploited.
- Huma Finance V1: The first version of a DeFi credit lending protocol; fund withdrawal interfaces were not fully disabled after migration.
- Raydium Legacy AMM: An old liquidity pool on Solana; attackers called a forgotten withdraw function to extract accumulated LP tokens.
- Aztec Connect: A privacy bridge’s earlier version; unrevoked fee withdrawal permissions were abused.
Industry Lessons: Retirement Must Be Complete
This incident reinforces a critical DeFi security principle: retiring a contract is more than just stop using it. Best practices include: 1) calling selfdestruct to destroy the contract; 2) sending remaining balance to a burn address; 3) revoking all admin roles and token approvals; 4) publicly announcing the contract is no longer active. Projects and users should also regularly audit deprecated contracts and employ automated monitoring tools to detect unprotected funds in zombie contracts. Security firms estimate that hundreds of abandoned contracts still hold over $50 million in assets, suggesting attacks of this nature may escalate.
Market Impact
While individual losses have not triggered systemic risk, the recurring pattern of zombie contract exploits is eroding investor confidence in DeFi protocols. In the short term, tokens of affected projects may face selling pressure. Longer term, the industry will likely adopt stricter lifecycle management standards for smart contracts. On-chain sleuths and auditors have already urged exchanges and wallet providers to proactively flag high-risk old contracts to reduce user exposure.