A recent report by MarsBit reveals that hackers have siphoned nearly $17 million from five deprecated yet still-functional smart contracts over the past 40 days. Dubbed 'zombie contracts', these are codebases that remain on-chain even after their original teams have abandoned or moved on, without proper removal of administrative privileges, fund withdrawal, or interface deactivation. Attackers targeted precisely this security blind spot, turning old contracts into cash machines.
Targets and Attack Methodology
The affected projects are DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect. By analyzing historical on-chain transactions and contract bytecode, attackers identified that these contracts, though officially retired, still retained admin keys, residual liquidity, or callable external functions. They leveraged leftover privileges to directly extract funds, or exploited unclosed interfaces to forge deceptive transactions. The campaign lasted 40 days, accumulating approximately $17 million in losses.
Why 'Zombie Contracts' Are High-Value Targets
At the core of this issue is the failure of smart contract lifecycle management. When a project upgrades or abandons a protocol, failing to revoke admin access, sweep remaining assets, or freeze interaction entry points leaves the contract in an active state on-chain. Attackers can reverse-engineer old code for vulnerabilities—such as unguarded authorization functions or obsolete proxy logic—or simply call emergency admin functions. Because the community and auditors typically no longer monitor old contracts, attackers can operate undetected for extended periods.
Lessons for the DeFi Ecosystem
This incident underscores that the retirement process of smart contracts must be as rigorous as deployment. Recommended actions before deprecating a contract include: 1) Call renounceOwnership() or transfer admin rights to a null address; 2) Withdraw all funds to a multisig wallet and complete liquidation; 3) Add an irreversible pause mechanism within the contract; 4) Conduct a final audit and publish a public deprecation notice. Additionally, on-chain monitoring tools should flag anomalous interactions with old contracts, and the community should proactively scan for historical 'zombie contracts'.
Conclusion
The $17 million loss was not due to novel attack vectors, but to well-known operational negligence. As DeFi rapidly iterates, countless retired contracts linger on-chain, forming ticking time bombs for the industry. Projects must embed contract retirement into their security playbook to eliminate these digital cash machines at the source.