Event Summary: Five 'Zombie Contracts' Drained of $17M in 40 Days
In the past 40 days, hackers have exploited five abandoned but still-onchain smart contracts to steal approximately $17 million. This series of attacks underscores a persistent security gap in decentralized finance: incomplete contract decommissioning. The affected projects span DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect. Although these contracts were marked as deprecated by their respective teams, they remained active on-chain with lingering funds, admin privileges, or external access points — transforming them into prime targets for attackers.
What Are Zombie Contracts and Why Are They High-Risk?
'Zombie contracts' refer to smart contracts that have been abandoned by their owners but still exist and remain functional on the blockchain. Because they are no longer monitored or audited, any leftover funds, admin keys, or unrevoked approvals become easy prey. In this incident, each of the five contracts exhibited similar weaknesses: some still held liquidity pool tokens or governance tokens; others had never disabled critical functions like withdraw or upgradeTo, allowing attackers to siphon assets through carefully crafted transactions.
Attack Vectors and Project Responsibility
Hackers typically locate these contracts through on-chain analytics, then reverse-engineer the source code (often publicly available) to find unprotected functions or outdated permission controls. For instance, DxSale, a decentralized token launchpad, had deprecated contracts that still retained token ownership or withdrawal rights. Raydium’s Legacy AMM left old liquidity pools unfrozen after migrating to a new AMM version. Aztec Connect’s privacy bridge maintained router functionality even after the service was shut down. Common project oversights include failing to call selfdestruct, neglecting to revoke EIP-2612 permit signatures, and not transferring all funds to an active contract or burn address.
Preventive Measures: Lifecycle Management for DeFi Contracts
This incident serves as a wake-up call for the entire DeFi industry. Projects should integrate contract decommissioning into their security standard operating procedures. Recommended steps include: (1) draining all user and protocol funds from the old contract; (2) revoking admin keys, proxy upgrade roles, and any external approvals; (3) calling selfdestruct or setting an irreversible pause; (4) stopping all cross-contract authorization calls; and (5) publicly announcing the contract’s status and advising users to revoke their approvals. Security auditors should also review the retirement plan as part of their assessment, ensuring that the entire lifecycle — from deployment to decommission — is properly handled.