Overview: Zombie Contracts Become ATMs for Hackers
In just 40 days, hackers siphoned nearly $17 million from five smart contracts that had been officially abandoned yet remained live on-chain, according to MarsBit. These so-called 'zombie contracts' – deprecated by their developers but never fully deactivated – retained funds, admin privileges, or still-accessible function calls, turning them into lucrative targets for attackers.
The Five Compromised Contracts
The attack targeted DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect – each a former DeFi project that had moved on to newer versions without cleaning up old contracts. Hackers exploited lingering vulnerabilities such as unrevoked owner keys, unwithdrawn liquidity pools, or unguarded entry functions to drain assets.
Root Cause: Incomplete Contract Retirement
Smart contracts are immutable once deployed; simply shutting down the frontend or announcing deprecation does not make them safe. If a contract still holds funds (e.g., unclaimed LP tokens), retains admin permissions (e.g., owner role not renounced), or fails to disable critical functions (e.g., withdraw, approve), it remains exploitable. The five cases here demonstrate a systematic oversight in DeFi lifecycle management.
Industry Impact and Lessons
This incident underscores the urgent need for standardized contract retirement procedures. Project teams should:
- Transfer all remaining funds to a secure address or burn them.
- Revoke or destroy all admin permissions (e.g., call renounceOwnership).
- Disable all potentially dangerous external functions (e.g., using selfdestruct or setting a death variable).
- Publicly disclose the retired contract addresses and their handling status to the community.
For investors, caution is advised when interacting with any contract that appears 'dead' – hackers may have already taken up residence. On-chain monitoring tools should also enhance alerts for zombie contract activity.