Incident Overview: $17M Stolen in 40 Days
In the past 40 days, attackers have exploited five abandoned yet still functional smart contracts—often referred to as 'zombie contracts'—to siphon nearly $17 million from the crypto ecosystem. The contracts in question belong to DxSale, TrustedVolumes, Huma Finance V1, Raydium Legacy AMM, and Aztec Connect, spanning decentralized exchanges, lending protocols, and privacy bridges. By invoking leftover functions or leveraging unrevoked admin privileges, the hackers drained locked funds from these outdated contracts into their own wallets.
Root Causes: Why Zombie Contracts Persist
The core issue stems from project teams failing to properly retire old contracts after migrating to newer versions. Three key vulnerabilities stand out: residual balances (liquidity pool tokens or protocol fees left untouched), unrevoked admin permissions (allowing attackers to call privileged functions), and open external interfaces (such as oracle update or withdrawal functions). Since smart contracts on blockchains are immutable and cannot be deleted by default (unless selfdestruct is used), any leftover logic remains exploitable. For example, Raydium Legacy AMM's old pool contract had its front-end shut down in 2022, but the on-chain contract remained active, eventually being used to drain the remaining liquidity.
Industry Lessons: Prevention and Mitigation
This incident serves as a stark reminder for DeFi teams to implement robust contract retirement procedures. Best practices include: draining all balances to zero, revoking all admin keys and role-based permissions, disabling all external function calls (e.g., through access control modifiers), and, where possible, using selfdestruct or a built-in 'circuit breaker' to permanently deactivate the contract. Additionally, projects should monitor old contracts with automated tools to detect suspicious activity. Security auditors must also include retirement verification in their scope—reviewing not only new code but also the status of legacy contracts to ensure no funds or permissions remain at risk.