The next DeFi drain could come from legacy contracts everyone forgot – Crypto News – Crypto News
Connect with us
Gino Matos Gino Matos

De-fi

The next DeFi drain could come from legacy contracts everyone forgot – Crypto News

Published

1 day ago

on

The Raydium AMM V3 exploit drained roughly $1.34 million from a phased-out program tied to five pools outside the current product path, unsupported by Raydium’s UI or SDK, and inaccessible to current users.

The exploit hit legacy DeFi contracts and infrastructure that nobody treated as a live attack surface, exposing a lifecycle-management failure that extends well beyond one Solana decentralized exchange.

The category nobody is counting

Public exploit reports have found at least eight clear cases since March 2025 in which deprecated, obsolete, or legacy DeFi contracts became the attack surface, totaling roughly $10.8 million in losses.

Extending the definition to include broader legacy-vault and legacy-product failures lifts the count to about ten incidents and $22.5 million, including Raydium.

Exploit trackers classify incidents by technical mechanisms, such as smart contract bugs, access control failures, oracle manipulations, private key compromises, and bridge flaws.

Zombie contracts, or legacy DeFi contracts still callable after retirement, belong to a different axis entirely: a lifecycle state that consistently vanishes inside broader exploit labels.

Exploit label databases usually use What it captures What it misses
Smart contract bug The code flaw that let funds move Whether the contract was deprecated, obsolete, or outside the active product
Access control failure Missing or broken permission checks Whether the affected deployment should still have been callable
Business logic flaw Broken assumptions inside protocol logic Whether the logic belonged to old infrastructure no longer supported by the UI/SDK
Oracle/accounting issue Incorrect pricing, balances, or shares Whether the vault or pool was a legacy product
Zombie-contract / lifecycle risk Deprecated infrastructure still live on-chain The missing category: contracts that were “retired” in product terms but not decommissioned technically

Raydium’s AMM V3 pools were deprecated after Serum’s own deprecation rendered them inert. The legacy program was built to place orders on the Serum order book, and once Serum wound down, it lost its only function and left associated liquidity idle.

Raydium’s current programs use a virtual supply mechanism for proportion checks and verify LP mint addresses along with all other relevant account information.

The legacy program skipped both checks, letting an attacker create a new mint, present it as the LP token, and bypass proportion controls entirely.

Roughly 150,177 RAY, 5,603 SOL, and 893,700 USDC had been sitting in pools outside the current product but stayed callable on-chain.

One pattern for eight incidents

In March 2025, 1inch lost roughly $5 million when an obsolete Fusion v1 resolver contract implementation was exploited.

In October 2025, Abracadabra lost $1.8 million due to deprecated Cauldron V4 contracts that remained active and exploitable because of a logic flaw. In December 2025, Yearn’s legacy iEarn TUSD vault was drained of roughly $300,000, while Yearn’s current v2 and v3 vaults remained clean.

Things escalated in May: SlowMist reported Transit Finance losing $1.88 million through a deprecated 2022-era TRON contract, and Huma Finance lost roughly $101,000 through deprecated V1 BaseCreditPool contracts on Polygon.

Renegade lost approximately $209,000 due to a legacy V1 Arbitrum deployment exposed by an unprotected initializer and a migration issue, with white-hat recovery reducing the net impact.

Scallop lost roughly $140,000 due to a deprecated rewards contract, leaving the core lending infrastructure clean.

Every protocol made the same claim that current users were safe and current programs intact, and every protocol still paid out from the treasury, because the old infrastructure had stayed callable long after it left the active product path.

Protocol Date Legacy surface exploited Approx. loss Why it fits the pattern
1inch Mar. 2025 Obsolete Fusion v1 resolver implementation ~$5.0M Old resolver logic remained relevant enough to exploit after the protocol had moved on.
Abracadabra Oct. 2025 Deprecated Cauldron V4 contracts ~$1.8M Deprecated contracts remained active and exploitable through a logic flaw.
Yearn Dec. 2025 Legacy iEarn TUSD vault ~$0.3M Legacy vault was drained while current Yearn vaults remained unaffected.
Transit Finance May 2026 Deprecated 2022-era TRON contract ~$1.88M Old contract surface stayed live after deprecation and became the attack path.
Huma Finance May 2026 Deprecated V1 BaseCreditPool contracts on Polygon ~$0.101M Retired architecture still held exploitable value outside the current system.
Renegade May 2026 Legacy V1 Arbitrum deployment ~$0.209M Migration and initializer issues exposed an old deployment.
Scallop 2026 Deprecated rewards-side contract ~$0.14M Core lending infrastructure stayed clean, but old rewards infrastructure was exploitable.
Raydium 2026 Legacy AMM V3 pools ~$1.34M Current UI/SDK and users were unaffected, but old pools remained callable on-chain.

Why databases lose this

Most exploit classifications focus on how the attacker got in, what they manipulated, and which code failed, a mechanism-first lens that obscures zombie contract exploits, where the core failure is that the infrastructure was supposed to be retired.

CryptoSlate Daily Brief

Daily signals, zero noise.

Market-moving headlines and context delivered every morning in one tight read.