Over the past 40 days, hackers have siphoned nearly $17 million from five abandoned but still active smart contracts, collectively known as 'zombie contracts.' These outdated contracts, once used by prominent DeFi projects, were left partially operational—still holding funds, retaining admin permissions, or allowing external calls. The attacks targeted contracts from DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect, exposing a critical gap in contract lifecycle management across the decentralized finance ecosystem.
What Are Zombie Contracts?
Zombie contracts are smart contracts that have been deprecated by their project teams but remain deployed on-chain and functional. Common scenarios include legacy contracts that were never disabled, admin keys that were never revoked, or locked liquidity and unclaimed fees that were left behind. While these contracts are no longer officially maintained, their code and potential vulnerabilities persist, often without any security monitoring. Security firms have repeatedly warned that such contracts are low-hanging fruit for attackers.
The Five Targeted Projects
Each of the five contracts came from well-known protocols: DxSale (token sale platform), TrustedVolumes (volume bot), Huma Finance V1 (credit protocol), Raydium Legacy AMM (Solana-based decentralized exchange), and Aztec Connect (privacy transfer protocol). After being deprecated, these contracts still contained substantial assets or critical permission structures. Hackers crafted transactions to bypass original security checks and directly withdraw funds. The diversity of blockchains and protocols suggests a systematic search for vulnerable legacy code rather than opportunistic hits.
Attack Vectors
Preliminary analysis by blockchain security teams reveals three primary attack vectors. First, attackers exploited undeleted withdraw or transfer functions still present in the old contracts. Second, they leveraged upgrade or permission loopholes to regain control of the contract logic. Third, they used cross-contract calls, treating the zombie contract as a stepping stone to compromise other active protocols. Some of the exploited contracts had been abandoned for over a year without any security audit or explicit deactivation.
Lessons for the Industry
This wave of attacks underscores a critical lesson for DeFi projects: contract decommissioning must be absolute. Recommended practices include calling selfdestruct or sweep to drain all balances, revoking all admin keys to the zero address, marking contract status on-chain to prevent interaction, and regularly scanning historical deployments for zombie contracts. Users should verify the safety of old versions before interacting and avoid phishing traps. Security auditors are urged to include decommissioned contracts in their routine checks.
Conclusion
As of press time, a portion of the stolen funds has been moved through mixers, making recovery unlikely. The incidents have sparked renewed debate over DeFi security audit standards, particularly regarding deprecated contracts. Industry experts are calling for a unified 'zombie contract' blacklist to help users and protocols mitigate risk. Going forward, rigorous lifecycle management will become an essential pillar of DeFi security.