Event Overview: Zombie Contracts Looted $17M
According to MarsBit, hackers have exploited five deprecated but still live smart contracts to drain approximately $17 million over the past 40 days. These contracts, known as 'zombie contracts,' were abandoned by their projects but remain functional on-chain because decommissioning was incomplete — they still hold funds, retain admin privileges, or have callable entry points, effectively becoming ATMs for attackers.
Affected Projects and Contract Details
The five targeted contracts belong to: DxSale (decentralized token launchpad), TrustedVolumes (on-chain data analytics tool), Huma Finance V1 (decentralized credit protocol), Raydium Legacy AMM (old version automated market maker on Solana), and Aztec Connect (privacy DeFi bridge). Hackers exploited residual functions or unrevoked permissions to directly withdraw locked funds from these contracts.
Root Cause: Incomplete Decommissioning
The core issue is that when projects upgrade or migrate contracts, they fail to fully disable all functional entry points on the old contracts. Many teams only remove the front-end interface but leave the on-chain contracts callable; some contracts still retain unrevoked admin keys or trapped token balances. Attackers systematically scan public blockchain data, test deprecated contracts for residual access, and drain them once found.
Implications for DeFi Security
This incident underscores the urgent need for a 'chain-death' standard: revoke all permissions, transfer remaining balances, and freeze or self-destruct deprecated contracts. The DeFi ecosystem is littered with historical versions and abandoned contracts that pose a hidden risk. Moving forward, automated monitoring tools should be implemented to flag long-idle contracts for risk assessment. Raydium's case is illustrative — it migrated to a new AMM in 2024, but the old liquidity pool remained vulnerable and was ultimately exploited.