Now readingArticle

The next DeFi drain could come from legacy contracts everyone forgot

Back to TopTopShare

Top Categories

  • Bitcoin News](/content/news/bitcoin/index.html)
  • Ethereum News](/content/news/ethereum/index.html)
  • XRP News](/content/news/xrp/index.html)
  • Solana News](/content/news/solana/index.html)

Trending Now

SpaceX’s IPO exposes the first crack in tokenized stocks – fragmented ownership and allocationTokenizationJun 13, 2026](/content/spacexs-ipo-exposes-the-first-crack-in-tokenized-stocks/index.html)

Latest Crypto News

The future of vaults: neobanks and invisible DeFiDeFiJun 13, 2026](/content/the-future-of-vaults-neobanks-and-invisible-defi/index.html) US export order removes Anthropic Mythos model access fueling crypto bets on AI that is beyond government reachAIJun 13, 2026](/content/us-anthropic-fable-mythos-crackdown-fuels-crypto-bet-on-ai-that-is-beyond-government-reach/index.html)

Coverage

Market Movers

Market Views

Popular Prices

  • Bitcoin](/content/coins/bitcoin/index.html)
  • Ethereum](/content/coins/ethereum/index.html)
  • XRP](/content/coins/xrp/index.html)
  • Solana](/content/coins/solana/index.html)

Sectors

Ecosystems

  • Ethereum](/content/blockchain/ethereum/index.html)
  • Binance Chain](/content/blockchain/binance-chain/index.html)
  • Solana](/content/blockchain/solana/index.html)
  • Polygon](/content/blockchain/polygon/index.html)

California Governor Election WinnerXavier Becerra 88.9%](/content/predictions/market/california-governor-election-2026/index.html) Knicks vs. SpursSpurs 64.5%](/content/predictions/market/nba-nyk-sas-2026-06-13/index.html) **Will the Iranian regime fall by June 30?**No 99.1%](/content/predictions/market/will-the-iranian-regime-fall-by-june-30/index.html) **Kharg Island no longer under Iranian control by…?**August 31 7%](/content/predictions/market/kharg-island-no-longer-under-iranian-control-by-march-31/index.html)

View all trending markets

Crypto Politics Sports Finance Tech Culture

Global Elections Bitcoin Iran US Election NBA Tech Aliens Business Economic Policy Formula 1

Recent

Tennessee Strategic Bitcoin Reserve Act (HB 1695)ExpiredHB1695 would have authorized Tennessee’s state treasurer to invest limited eligible state funds in Bitcoin with caps, custody...](/content/crypto-laws/tennessee-strategic-bitcoin-reserve-act-hb-1695/index.html) South Dakota HB 1155: State Bitcoin Investment BillExpiredSouth Dakota HB 1155 would have permitted the State Investment Council to invest up to 10% of eligible...](/content/crypto-laws/south-dakota-hb-1155-state-bitcoin-investment/index.html) Strategic Digital Assets Reserve Act of South Carolina (H. 4256)In committeeSouth Carolina H. 4256 would authorize State Treasurer investment in certain digital assets, including Bitcoin, under proposed reserve,...](/content/crypto-laws/south-carolina-h-4256-strategic-digital-assets-reserve-act/index.html)

Jurisdictions

  • United States](/content/crypto-laws/jurisdiction/united-states/index.html)
  • European Union](/content/crypto-laws/jurisdiction/european-union/index.html)
  • Singapore](/content/crypto-laws/jurisdiction/singapore/index.html)
  • United Kingdom](/content/crypto-laws/jurisdiction/united-kingdom/index.html)
  • India](/content/crypto-laws/jurisdiction/india/index.html)

Topics

Statuses

Law Types

Guide Series

Guide SeriesBuy Borrow DieBy CoinRabbitExplore why savvy investors borrow against crypto instead of selling, with insights on liquidity,...View series](/content/guides/series/buy-borrow-die/index.html) Guide SeriesInstitutional PlaybookBy WhiteBITExplore WhiteBIT’s Institutional Playbook, a 3-part guide series on exchange due diligence, crypto-as-a-service, and...View series](/content/guides/series/institutional-playbook/index.html)

View all series

Recent Guides

Crypto Basics Beginner What Is a Testnet and How Do Crypto Testnets Work?Before real funds move on a blockchain, developers and users test everything on a testnet....](/content/guides/what-is-a-testnet-and-how-do-crypto-testnets-work/index.html) DeFi Beginner Zero-Knowledge Proof (ZK Proof): What It Is and How It WorksZK proofs show up everywhere in crypto, from rollups to identity systems to shielded payments....](/content/guides/zero-knowledge-proof-zk-proof-what-it-is-and-how-it-works/index.html) Crypto Basics Beginner What Is Mainnet in Crypto And How Does It Work?A mainnet is the live version of a blockchain, where real money moves, fees are...](/content/guides/what-is-mainnet-in-crypto-and-how-does-it-work/index.html) Crypto Basics Beginner What Is the MACD Indicator and How To Use It?The MACD indicator is one of the most-used tools in crypto trading, but most beginners...](/content/guides/what-is-macd-indicator-how-to-use-it/index.html)

View all guides

Guide Categories

Crypto BasicsStart learning crypto with beginner-friendly guides to wallets, trading, blockchain,... DeFiExplore DeFi guides covering wallets, dapps, staking, liquidity, lending, yield,... BitcoinLearn Bitcoin basics with guides to BTC wallets, mining, security,... Wallet SecurityLearn wallet security basics, from addresses and seed phrases to... NFTs

Browse all categories

Review Categories

Browse Directory

Company Verticals

Product Categories

People Categories

Company

Help & Legal

Follow

Section Navigation

News

Latest News

SpaceX’s IPO exposes the first crack in tokenized stocks – fragmented ownership and allocationTokenizationJun 13, 2026](/content/spacexs-ipo-exposes-the-first-crack-in-tokenized-stocks/index.html) The future of vaults: neobanks and invisible DeFiDeFiJun 13, 2026](/content/the-future-of-vaults-neobanks-and-invisible-defi/index.html) US export order removes Anthropic Mythos model access fueling crypto bets on AI that is beyond government reachAIJun 13, 2026](/content/us-anthropic-fable-mythos-crackdown-fuels-crypto-bet-on-ai-that-is-beyond-government-reach/index.html) Wholesale inflation is back in focus. Here’s what PPI means for your money and BitcoinMacroBearishJun 13, 2026](/content/wholesale-inflation-is-back-in-focus-heres-what-ppi-means-for-your-money-and-bitcoin/index.html)

Asset Coverage

  • Bitcoin news](/content/news/bitcoin/index.html)
  • XRP news](/content/news/xrp/index.html)
  • Ethereum news](/content/news/ethereum/index.html)
  • Solana news](/content/news/solana/index.html)

Topic Coverage

Market Structure

Coins

Coin Views

Prices

  • Bitcoin price](/content/coins/bitcoin/index.html)
  • Ethereum price](/content/coins/ethereum/index.html)
  • XRP price](/content/coins/xrp/index.html)
  • Solana price](/content/coins/solana/index.html)

Sectors

Ecosystems

Prediction Markets

Prediction Markets

Laws

Browse

Recent

Tennessee Strategic Bitcoin Reserve Act (HB 1695)ExpiredHB1695 would have authorized Tennessee’s state treasurer to invest limited eligible state funds in Bitcoin with caps, custody...](/content/crypto-laws/tennessee-strategic-bitcoin-reserve-act-hb-1695/index.html)

South Dakota HB 1155: State Bitcoin Investment BillExpiredSouth Dakota HB 1155 would have permitted the State Investment Council to invest up to 10% of eligible...](/content/crypto-laws/south-dakota-hb-1155-state-bitcoin-investment/index.html) Strategic Digital Assets Reserve Act of South Carolina (H. 4256)In committeeSouth Carolina H. 4256 would authorize State Treasurer investment in certain digital assets, including Bitcoin, under proposed reserve,...](/content/crypto-laws/south-carolina-h-4256-strategic-digital-assets-reserve-act/index.html)

Jurisdictions

Topics

Statuses

Law Types

Learn

Featured Guides

Buy Borrow DieWhy long-term crypto holders borrow against assets instead of selling](/content/guides/why-long-term-crypto-holders-borrow-against-assets-instead-of-selling/index.html) Buy Borrow DieWhy collateral reuse is the hidden risk in crypto lending](/content/guides/why-collateral-reuse-is-the-hidden-risk-in-crypto-lending/index.html) Buy Borrow DieCapital preservation in practice: how major players use high-LTV crypto-backed loans](/content/guides/buy-borrow-die-high-ltv-crypto-loans/index.html) Institutional PlaybookThe Market Maker’s Exchange Checklist (Liquidity, Latency, and Risk Controls)](/content/guides/the-market-makers-exchange-checklist-liquidity-latency-and-risk-controls/index.html) Institutional PlaybookCrypto-as-a-Service Playbook: How Banks, Telcos, and Fintechs Launch Crypto Products Fast, Safely, and Compliantly](/content/guides/crypto-as-a-service-playbook-how-banks-telcos-and-fintechs-launch-crypto-products-fast-safely-and-compliantly/index.html)

Guide Categories

Reviews

Review Categories

Directory

Browse Directory

Company Verticals

Product Categories

People Categories

More

Company

Help & Legal

Follow

Search CryptoSlateSearch CryptoSlateesc

Searching...

No resultsTry a different name or ticker.

Jun. 11, 2026at 7:10 pm GMT• 5 min read

Quick Take

  1. 01 An attacker drained about $1.34 million from Raydium’s deprecated AMM V3 pools, years after they were phased out.
  2. 02 The incident shows old DeFi contracts can stay live on-chain, turning retired infrastructure into an overlooked attack surface.
  3. 03 Public reports already count at least eight similar legacy-contract exploits since March 2025, suggesting more forgotten code may still be callable.

[MakeCryptoSlatepreferred on")

Share on XShare on FacebookShare on TelegramShare on LinkedInShare via email

The Raydium AMM V3 exploit drained roughly $1.34 million from a phased-out program tied to five pools outside the current product path, unsupported by Raydium’s UI or SDK, and inaccessible to current users.

The exploit hit legacy DeFi contracts and infrastructure that nobody treated as a live attack surface, exposing a lifecycle-management failure that extends well beyond one Solana decentralized exchange.

The category nobody is counting

Public exploit reports have found at least eight clear cases since March 2025 in which deprecated, obsolete, or legacy DeFi contracts became the attack surface, totaling roughly $10.8 million in losses.

Advertise with CryptoSlate

Extending the definition to include broader legacy-vault and legacy-product failures lifts the count to about ten incidents and $22.5 million, including Raydium.

Exploit trackers classify incidents by technical mechanisms, such as smart contract bugs, access control failures, oracle manipulations, private key compromises, and bridge flaws.

Zombie contracts, or legacy DeFi contracts still callable after retirement, belong to a different axis entirely: a lifecycle state that consistently vanishes inside broader exploit labels.

Exploit label databases usually use What it captures What it misses
Smart contract bug The code flaw that let funds move Whether the contract was deprecated, obsolete, or outside the active product
Access control failure Missing or broken permission checks Whether the affected deployment should still have been callable
Business logic flaw Broken assumptions inside protocol logic Whether the logic belonged to old infrastructure no longer supported by the UI/SDK
Oracle/accounting issue Incorrect pricing, balances, or shares Whether the vault or pool was a legacy product
Zombie-contract / lifecycle risk Deprecated infrastructure still live on-chain The missing category: contracts that were “retired” in product terms but not decommissioned technically

Raydium's AMM V3 pools were deprecated after Serum's own deprecation rendered them inert. The legacy program was built to place orders on the Serum order book, and once Serum wound down, it lost its only function and left associated liquidity idle.

Raydium's current programs use a virtual supply mechanism for proportion checks and verify LP mint addresses along with all other relevant account information.

The legacy program skipped both checks, letting an attacker create a new mint, present it as the LP token, and bypass proportion controls entirely.

Roughly 150,177 RAY, 5,603 SOL, and 893,700 USDC had been sitting in pools outside the current product but stayed callable on-chain.

One pattern for eight incidents

In March 2025, 1inch lost roughly $5 million when an obsolete Fusion v1 resolver contract implementation was exploited.

In October 2025, Abracadabra lost $1.8 million due to deprecated Cauldron V4 contracts that remained active and exploitable because of a logic flaw. In December 2025, Yearn's legacy iEarn TUSD vault was drained of roughly $300,000, while Yearn's current v2 and v3 vaults remained clean.

Things escalated in May: SlowMist reported Transit Finance losing $1.88 million through a deprecated 2022-era TRON contract, and Huma Finance lost roughly $101,000 through deprecated V1 BaseCreditPool contracts on Polygon.

Renegade lost approximately $209,000 due to a legacy V1 Arbitrum deployment exposed by an unprotected initializer and a migration issue, with white-hat recovery reducing the net impact.

Scallop lost roughly $140,000 due to a deprecated rewards contract, leaving the core lending infrastructure clean.

Every protocol made the same claim that current users were safe and current programs intact, and every protocol still paid out from the treasury, because the old infrastructure had stayed callable long after it left the active product path.

Protocol Date Legacy surface exploited Approx. loss Why it fits the pattern
1inch Mar. 2025 Obsolete Fusion v1 resolver implementation ~$5.0M Old resolver logic remained relevant enough to exploit after the protocol had moved on.
Abracadabra Oct. 2025 Deprecated Cauldron V4 contracts ~$1.8M Deprecated contracts remained active and exploitable through a logic flaw.
Yearn Dec. 2025 Legacy iEarn TUSD vault ~$0.3M Legacy vault was drained while current Yearn vaults remained unaffected.
Transit Finance May 2026 Deprecated 2022-era TRON contract ~$1.88M Old contract surface stayed live after deprecation and became the attack path.
Huma Finance May 2026 Deprecated V1 BaseCreditPool contracts on Polygon ~$0.101M Retired architecture still held exploitable value outside the current system.
Renegade May 2026 Legacy V1 Arbitrum deployment ~$0.209M Migration and initializer issues exposed an old deployment.
Scallop 2026 Deprecated rewards-side contract ~$0.14M Core lending infrastructure stayed clean, but old rewards infrastructure was exploitable.
Raydium 2026 Legacy AMM V3 pools ~$1.34M Current UI/SDK and users were unaffected, but old pools remained callable on-chain.

Why databases lose this

Most exploit classifications focus on how the attacker got in, what they manipulated, and which code failed, a mechanism-first lens that obscures zombie contract exploits, where the core failure is that the infrastructure was supposed to be retired.

CryptoSlate Daily Brief

Daily signals, zero noise.

Market-moving headlines and context delivered every morning in one tight read.

5-minute digest 100k+ readers

Email address

Get the brief

Free. No spam. Unsubscribe any time.

Whoops, looks like there was a problem. Please try again.

You’re subscribed. Welcome aboard.

Transit's deprecated TRON contract was an old protocol surface that nobody decommissioned. Scallop's deprecated rewards contract was an accounting flaw in infrastructure that the team had moved past. Huma's V1 BaseCreditPool was retired architecture still holding assets on a chain the protocol had migrated away from.

A 2025 SoK paper analyzing 50 severe real-world exploits from 2022 to 2025, totaling over $1 billion in losses, argued that high-impact incidents frequently involve exploit chains spanning human, operational, economic, lifecycle, and governance layers.

The authors proposed a four-tier root-cause framework that treats lifecycle and governance failures as a distinct category alongside implementation errors. Zombie contracts fit that framework: lifecycle failures that exploit databases are absorbed into implementation-bug counts, keeping the cumulative dollar figure buried inside unrelated categories.

The fork in the graveyard

If protocols continue to treat decommissioning as an afterthought, deprecating contracts in product documentation without draining, pausing, or monitoring them, attackers will keep scanning the graveyard.

Every major protocol's deployment history becomes a searchable attack surface. The $22.5 million current estimate is a floor, based on incidents that made it into public reporting with sufficient detail to classify.

Legacy vaults, forgotten approval surfaces, and old integrations that still hold assets but sit outside active user flows receive far less monitoring than live infrastructure, which is what attackers scan for.

If the category gets named and counted, if decommissioning checklists become standard practice alongside audits, the attack surface shrinks through maintenance.

Raydium's treasury absorbs the $1.3 million exploit, Transit's team promised compensation, and Huma covered its losses.

That makes DeFi contract decommissioning a security control rather than a documentation task.

Decommissioning control What it means Why it matters
Drain idle assets Remove funds from retired pools, vaults, and reward contracts. Eliminates the financial incentive for attackers to scan abandoned infrastructure.
Pause callable functions Disable swaps, withdrawals, reward claims, or admin functions where possible. Turns “deprecated” into an actual security state rather than a product label.
Verify LP mints, approvals, and permissions Review old mint checks, approvals, authorities, and account assumptions. Prevents attackers from exploiting stale validation logic or forgotten permissions.
Monitor legacy deployments Keep alerts active for old contracts, pools, and chain deployments. Prevents abandoned infrastructure from becoming invisible to the team but visible to attackers.
Keep legacy code in bug-bounty scope Include retired or deprecated infrastructure in security programs. Gives white hats a reason to report issues before attackers exploit them.
Publish retirement status Clearly identify whether old products are drained, paused, monitored, or unsupported. Helps users, integrators, and analysts distinguish “not in the UI” from “not risky.”
Define treasury liability State whether the protocol will compensate losses from retired infrastructure. Makes clear whether old code remains an implicit claim on the protocol treasury.

Deprecating a contract transfers the security liability to the treasury while leaving the attack surface intact. Retiring infrastructure without decommissioning it keeps it live, with the team's attention diverted and the attacker's incentive intact.

In addition to total value locked, DeFi protocols accumulate history, and history can be exploited.

Raydium](/content/coins/raydium/index.html) USDC](/content/coins/usd-coin/index.html) Solana](/content/coins/solana/index.html) Polygon](/content/coins/polygon/index.html) Arbitrum](/content/coins/arbitrum/index.html) TrueUSD](/content/coins/true-usd/index.html) 1inch Network](/content/companies/1inch-network/index.html) Raydium](/content/companies/raydium/index.html)

Featured DeFi Hacks Crime

Advertise with CryptoSlate

Context

Related coverage

Explore related reporting by asset, place, or topic.

DeFi

\ \ DeFi\ \ The future of vaults: neobanks and invisible DeFi \ \ Kraken’s early traction suggests the next wave of DeFi adoption will come through neobanks and fintech apps that hide vault complexity behind familiar savings products.\ \ 3 hours ago](/content/the-future-of-vaults-neobanks-and-invisible-defi/ "The future of vaults: neobanks and invisible DeFi"/index.html)

\ \ DeFiBearish\ \ Why is Solana falling despite ETF inflows and booming activity? \ \ Solana ETF inflows and network activity are rising, but inflation, weak fee burn, and macro pressure still weigh on SOL.\ \ 2 days ago](/content/why-is-solana-falling/ "Why is Solana falling despite ETF inflows and booming activity?"/index.html)

\ \ CrimeBearish\ \ Humanity Protocol hack turns one laptop breach into an identity-token crisis \ \ A $36 million H exploit shows how one custody failure can threaten a project built around digital identity trust.\ \ 3 days ago](/content/humanity-protocols-h-crash-exposes-the-private-keys-behind-its-zk-identity-pitch/ "Humanity Protocol hack turns one laptop breach into an identity-token crisis"/index.html)

CryptoSlate may use AI tools to support research, editing, and production workflows. Published articles remain editorially reviewed by our team. Read our full AI usage disclaimer.

Our writers' opinions are solely their own and do not reflect the opinion of CryptoSlate. None of the information you read on CryptoSlate should be taken as investment advice, nor does CryptoSlate endorse any project that may be mentioned or linked to in this article. Buying and trading cryptocurrencies should be considered a high-risk activity. Please do your own due diligence before taking any action related to content within this article. Finally, CryptoSlate takes no responsibility should you lose money trading cryptocurrencies. For more information, see our company disclaimers.

×

Expand

More about