Incident Overview: 40 Days, 5 Contracts, ~$17M Lost
Over the past 40 days (as of June 27, 2026), attackers have siphoned approximately $17 million in crypto assets by exploiting five smart contracts that were abandoned but still active on-chain. These so-called 'zombie contracts' belong to five projects: DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect.
Root Cause: Incomplete Contract Retirement
Security analysis reveals that the core vulnerability lies in the failure of project teams to fully remove funds, permissions, or callable entry points when disabling old contracts. Many zombie contracts still hold user-staked tokens, admin withdrawal privileges, or integration interfaces with other protocols. Attackers monitor these dormant contracts on-chain, locate balances or loopholes, and then leverage remaining privileged functions to transfer assets out.
Project Breakdown
- DxSale – A decentralized token launchpad; its legacy contract was exploited for several million dollars.
- TrustedVolumes – An on-chain transaction volume aggregator; the old contract still held funds.
- Huma Finance V1 – A credit lending protocol; the V1 contract was not fully decommissioned, allowing extraction of long-locked collateral.
- Raydium Legacy AMM – An old automated market maker contract from Solana’s leading DEX Raydium; hackers used retained permissions to drain liquidity.
- Aztec Connect – A privacy bridge protocol; funds in its outdated contract were transferred out.
Industry Implications: How to Prevent Zombie Contract Attacks
This string of attacks serves as a stark reminder: decommissioned contracts must undergo a complete 'kill' process – freeze all funds, revoke admin permissions, destroy the contract owner, and sever all external protocol connections. Teams should conduct regular on-chain audits to clean up historical contract balances. For users, it is critical to withdraw assets from deprecated contracts promptly and avoid leaving tokens idle in unmaintained contracts.
As the DeFi ecosystem matures, governance and security practices for legacy contracts will become an essential infrastructure requirement. This incident may push security audit firms to develop specialized scanning tools for zombie contracts, enabling project teams to detect and remediate high-risk legacy contracts in a timely manner.