Overview: $17M Stolen in 40 Days via Zombie Contracts
According to MarsBit, hackers have drained approximately $17 million from five deprecated yet still functional smart contracts over the past 40 days. The targeted contracts belong to DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect, covering diverse DeFi sectors including launchpads, volume oracles, lending, AMMs, and privacy bridges.
What Are Zombie Contracts?
'Zombie contracts' are smart contracts that have been officially deprecated by their developers but remain live on-chain, retaining funds, permissions, or access points. Because DeFi contracts are immutable, deprecation does not automatically disable them. If the contract still holds user assets, admin privileges, or unrevoked approvals, attackers can exploit its logic flaws or leftover permissions for profit.
In this case, hackers monitored the blockchain for high-value zombie contracts, then extracted funds using leftover liquidity pool authorities, unwithdrawn liquidity, or unchecked approvals. Security analysts point out that the common thread across all five incidents is the project teams' failure to fully clean up assets and permissions after upgrading or migrating.
Detailed Breakdown of Each Incident
DxSale: Mint Permission Left Open
DxSale is a decentralized token launch platform. Attackers exploited a leftover mint permission in an old version contract, creating and withdrawing tokens worth approximately $6 million. The contract was marked deprecated but the admin mint function was not revoked.
TrustedVolumes: Residual Reward Distribution
TrustedVolumes provides on-chain volume data. Its old contract retained the ability to distribute rewards to certain addresses. Hackers used this to drain about $3.2 million.
Huma Finance V1: Stuck Collateral in Lending Pool
Huma Finance V1 is a deprecated lending protocol. When V2 launched, V1's pools still contained about $2.5 million in collateral. Attackers called a liquidation function that was not disabled, wiping out the collateral.
Raydium Legacy AMM: Untouched Liquidity in Old Pools
Raydium's Legacy AMM contract still held some unmigrated liquidity. Hackers manipulated the price oracle and arbitraged approximately $3.8 million from the old pools.
Aztec Connect: Replay Attack on Bridge
Aztec Connect's deprecated privacy bridge contract had not frozen message-passing mechanisms. Attackers used a replay attack to steal about $1.5 million.
Lessons and Defensive Measures
These attacks serve as a stark warning to DeFi projects. First, deprecating a contract is not enough; a rigorous decommissioning checklist must be executed: withdraw all funds, revoke all approvals, pause all core functions. Second, ongoing on-chain monitoring is essential to detect residual risks in historical contracts. Finally, users should regularly audit and revoke token approvals for inactive contracts.
As of writing, most affected projects have not publicly addressed the incidents. On-chain data shows some stolen funds have been bridged to mixers, making recovery extremely difficult. DeFi security requires continuous investment and vigilance.