Incident Overview: How Was $17M Siphoned So Easily?
In the past 40 days, attackers exploited five abandoned yet still operational smart contracts to drain nearly $17 million. The contracts belong to DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect. Although these contracts were officially deprecated by their respective projects, the decommissioning process was incomplete: they still held token balances, retained admin-level permissions, or contained callable functions that allowed external invocation. This enabled hackers to bypass normal protocol logic and directly extract assets from the chain.
Root Cause: Incomplete Decommissioning Creates 'Zombie Contracts'
'Zombie contracts' are smart contracts that persist on-chain despite being abandoned by their developers. Common vulnerabilities include: failure to withdraw remaining liquidity or protocol tokens, failure to revoke privileged roles (e.g., owner functions), or presence of publicly callable 'backdoor' functions. Once such weaknesses are discovered through on-chain analytics tools, attackers repeatedly exploit them like automated teller machines. In this wave, hackers precisely located high-value targets by analyzing on-chain data, confirming that unmaintained contracts are now prime attack surfaces.
Industry Impact and Lessons Learned
The rapid iteration of the DeFi ecosystem has left a trail of outdated contracts, while blockchain immutability ensures they remain accessible forever. Projects undergoing protocol upgrades or migrations must establish a standardized decommissioning SOP that includes: completely emptying contract funds, revoking all permissions, disabling all callable functions, and publicly announcing the status change on frontends and social media. For security teams, regular on-chain scanning for zombie contracts and setting up automated alerts has become a necessity. This series of attacks sends a clear warning to the entire DeFi industry: deprecation is not the end; proper cleanup is the beginning of safety.