Incident Overview: $17M Stolen via Zombie Contracts in 40 Days
According to MarsBit, over the past 40 days hackers have exploited five abandoned yet still-operational smart contracts to drain approximately $17 million. These 'zombie contracts'—deprecated code still live on-chain—were left with residual funds, admin privileges, or callable interfaces, turning them into cash machines for attackers. The affected projects span multiple DeFi verticals: DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect, highlighting a systemic vulnerability in smart contract retirement practices.
What Are Zombie Contracts and Why Are They Targets?
A 'zombie contract' is a smart contract that has been officially deprecated by its project but not fully removed or frozen on-chain. Due to blockchain immutability, old contracts persist indefinitely. If the legacy logic still holds assets, administrative keys, or callbacks to newer versions, attackers can exploit unpatched flaws or outdated business logic to withdraw funds, mint tokens, or perform other malicious actions. In this case, each contract lost an average of ~$3.4 million, and hackers could operate without triggering immediate alerts since the contracts were no longer actively monitored.
Project-by-Project Breakdown
The five targeted contracts cover different DeFi segments:
- DxSale: A token launch and liquidity locking platform whose deprecated V1 contract retained permission hooks.
- TrustedVolumes: An on-chain volume verification protocol that left token pool controls intact after deprecation.
- Huma Finance V1: An early version of a decentralized credit protocol whose lending logic remained callable.
- Raydium Legacy AMM: The old automated market maker on Solana; although the team migrated to V2, the old pools still held LP tokens and protocol fees.
- Aztec Connect: A legacy privacy bridge contract that still allowed withdrawal of user deposits.
All these projects made the same mistake: failing to drain funds, revoke permissions, or remove admin keys before retiring the contracts.
Security Takeaways: How to Prevent Zombie Contract Risks
This incident sends a clear warning to the entire DeFi industry. When upgrading or discontinuing services, projects must follow a complete decommission checklist: 1) Withdraw all remaining funds (transfer to a new contract or burn); 2) Revoke all external roles (owner, admin); 3) Check for any lingering call permissions to or from other contracts; 4) Publish a public notice and guide users to migrate. Additionally, on-chain monitoring systems should continuously scan deprecated contracts for unusual transactions. For users, it's critical to respond promptly to official migration announcements and never leave assets in old version contracts.
As DeFi protocol iterations accelerate, zombie contract risks will only grow. The $17 million loss is a stark reminder: security is not a one-time audit but a continuous lifecycle management process.