Incident Overview: Deprecated Contracts Become Hackers' ATMs
According to MarsBit, over the past 40 days, attackers exploited five abandoned but still-operational smart contracts across prominent DeFi projects, siphoning approximately $17 million. These 'zombie contracts' — no longer maintained yet retaining on-chain funds, admin keys, or exposed functions — have become high-value targets. The affected projects include DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect, spanning launchpads, trading verifiers, lending markets, decentralized exchanges, and privacy bridges.
Project-by-Project Impact
While exact exploit details remain partially undisclosed, on-chain forensics trace the hacker’s movements: DxSale’s deprecated token sale contract still held approximately $4 million in locked liquidity; TrustedVolumes’ expired transaction verification contract retained a permission that allowed balance tampering; Huma Finance V1’s old lending pool, lacking complete authorization revocations, lost over $3 million; Raydium Legacy AMM’s stale liquidity pools still permitted direct swap calls; and Aztec Connect’s older privacy bridge contract held around $2.5 million in residual funds. The hacker combined function calls across these contracts over 40 days, moving stolen assets through mixers to obfuscate trails.
Root Cause: Incomplete Retirement of Smart Contracts
The core issue lies in the lack of systematic decommissioning processes at the protocol level. When projects upgrade or migrate, teams often simply hide the old UI or post announcements, rather than performing on-chain actions such as withdrawing all funds, revoking permissions, or self-destructing the contract. Since Ethereum smart contracts are immutable, the only way to remove code and storage is via the selfdestruct opcode, but many teams avoid it fearing loss of historical data or irreversible errors. As a result, contracts remain 'alive' — retaining ETH balances, accepting token transfers, or holding approvals — offering attackers a perfect entry point with outdated logic.
Mitigation Strategies and Industry Lessons
This incident underscores the need for a 'contract lifecycle' approach to DeFi security. Recommended practices include: emptying all funds from deprecated contracts to a secure address; calling selfdestruct where chain rules allow; revoking all third-party allowances (e.g., via revoke.approve); and clearly marking the contract as defunct on block explorers and front ends. Security monitoring tools should continuously scan old contracts for unusual balance changes or function calls, triggering alerts for suspicious activity. For users, it is critical to revoke allowances on contracts no longer in use, as dormant authorization can be exploited just as easily as contract funds.
With $17 million drained from just five zombie contracts in 40 days, the threat is real and growing. The DeFi industry must treat contract retirement as a first-class security requirement, not an afterthought.