Vampire Attack

What Is a Vampire Attack?

A vampire attack is a competitive strategy where a new DeFi protocol systematically drains users and liquidity from an established protocol. The attacker forks the target's open-source code, deploys a near-identical product, and then offers aggressively higher incentives (typically through liquidity mining rewards) to convince liquidity providers to migrate their capital.

The name draws on the metaphor of a vampire draining its victim's lifeblood: TVL (total value locked) is the lifeblood of most DeFi protocols, and a vampire attack aims to siphon it away. Unlike a traditional competitive launch, a vampire attack specifically targets an incumbent's existing user base rather than trying to grow a new one organically.

Vampire attacks are unique to DeFi and open-source crypto protocols. In traditional finance, proprietary software, regulatory moats, and contractual lock-ins make this strategy nearly impossible. In DeFi, open-source code and permissionless liquidity mean any protocol can be cloned and its users poached with the right incentive structure.

How It Works

A vampire attack follows a predictable sequence of steps, each designed to minimize friction for migrating users while maximizing pressure on the target protocol.

1. Fork the target's code: the attacker copies the target protocol's smart contracts, often with minimal modifications. Since most DeFi protocols are open source, this is trivially easy.
2. Add a token incentive: the attacker introduces a native governance token (or boosts an existing one) and distributes it to users who provide liquidity. These rewards are set higher than anything the target offers.
3. Accept the target's LP tokens: the attacker's protocol accepts the target's LP tokens as staking deposits. Users earn the new token without having to move their liquidity yet, lowering the barrier to participation.
4. Execute migration: at a predetermined time, the attacker's smart contract redeems the deposited LP tokens from the target protocol and re-deposits the underlying assets into its own liquidity pools. This mass withdrawal happens in a single transaction.
5. Sustain the network effects: after migration, the attacker must retain the liquidity by continuing rewards, building features, and establishing its own community. If incentives dry up, mercenary capital flows back.

Why Open-Source Code Enables Vampire Attacks

Vampire attacks exploit two fundamental properties of DeFi: forkability and liquidity portability. Any protocol deployed as a public smart contract can be copied in minutes. And unlike traditional finance where customer relationships are locked behind accounts, contracts, and switching costs, DeFi liquidity moves freely between protocols with a single on-chain transaction.

This creates an asymmetry: building a successful protocol takes months or years of development, auditing, and community building. Forking it takes an afternoon. The vampire attacker free-rides on the original team's work and then competes purely on short-term incentives.

The SushiSwap Case Study

The most famous vampire attack in crypto history occurred in September 2020 when SushiSwap targeted Uniswap, then the dominant decentralized exchange. This case study illustrates both the power and the limitations of the strategy.

Background

Uniswap had pioneered the automated market maker model, growing to hundreds of millions in TVL by mid-2020. However, Uniswap V2 had no governance token and no direct incentive for liquidity providers beyond trading fees. An anonymous developer known as Chef Nomi saw an opportunity.

The Attack

Chef Nomi forked Uniswap V2's code and created SushiSwap, adding a key difference: the SUSHI governance token. The attack proceeded in two phases:

• Phase 1 (farming): SushiSwap accepted Uniswap LP tokens as staking collateral. Users could stake their existing Uniswap LP positions on SushiSwap and earn SUSHI rewards. Within days, over $1.3 billion worth of Uniswap LP tokens had been deposited into SushiSwap's farming contracts.
• Phase 2 (migration): on September 9, 2020, SushiSwap executed its migration smart contract. This contract redeemed approximately $810 million worth of LP tokens from Uniswap and re-deposited the underlying token pairs into SushiSwap's own pools. Uniswap lost roughly 55% of its total liquidity in a single block.

The Aftermath

The attack did not kill Uniswap. Within weeks, Uniswap responded by launching its own governance token, UNI, with a retroactive airdrop to historical users. Uniswap eventually recovered and surpassed its pre-attack TVL. SushiSwap survived as a viable competitor but faced its own challenges: Chef Nomi sold the project's developer allocation of SUSHI for roughly $13 million in ETH (later returning the funds after community backlash), and control was transferred to a multisig led by Sam Bankman-Fried.

The episode demonstrated that while vampire attacks can successfully move large amounts of capital, sustaining that capital requires more than token emissions. Uniswap's brand, developer ecosystem, and continued innovation proved to be non-forkable moats.

Other Notable Vampire Attacks

The SushiSwap playbook inspired several other attempts across DeFi:

• LooksRare and Blur vs. OpenSea: in the NFT marketplace space, LooksRare (2022) and Blur (2023) used token incentives and fee rebates to lure traders away from OpenSea, which had no token. Blur's points-based system and zero-fee trading proved particularly effective at capturing market share.
• Curve Wars: protocols like Convex Finance competed to accumulate CRV governance tokens to direct liquidity mining rewards on Curve Finance. While not a traditional vampire attack, the dynamic of competing for another protocol's incentive flows shares similar mechanics.

Defense Strategies

The threat of vampire attacks has driven innovation in how protocols retain liquidity and build defensible positions.

Protocol-Owned Liquidity

Rather than renting liquidity from mercenary LPs, protocol-owned liquidity (POL) puts the protocol itself in control of its LP positions. Pioneered by OlympusDAO's bonding mechanism, POL lets protocols acquire LP tokens by selling discounted governance tokens to users. Since the protocol owns the liquidity directly, there are no external LPs to poach. The tradeoff: POL requires significant treasury capital and introduces token dilution.

Vesting and Lock-Up Periods

Protocols can require that liquidity mining rewards vest over time, so LPs who migrate forfeit unvested rewards. This raises the switching cost for mercenary capital. Some protocols implement early withdrawal penalties or progressive reward multipliers that increase with the duration of a deposit.

Non-Forkable Moats

The most durable defense is building value that cannot be copied with a fork:

• Brand and community: strong brand recognition and an engaged community create loyalty that survives incentive competition
• Integrations and composability: deep integrations with other protocols, wallets, and aggregators create switching costs that go beyond simple liquidity
• Continuous innovation: staying ahead on features (as Uniswap did with V3's concentrated liquidity) makes forks of older versions immediately obsolete
• Network effects: in payment networks and layer-2 protocols, value grows with the number of participants, making it harder for a fork to reach critical mass

Token Distribution

Uniswap's retroactive UNI airdrop demonstrated that distributing a governance token to loyal users can be a powerful defensive move. By rewarding historical participation, the protocol created a constituency with a financial stake in its success, making them less likely to migrate for short-term gains.

Why Vampire Attacks Are Rare Outside DeFi

Traditional financial services are largely immune to vampire attacks for several reasons:

• Proprietary technology: banks and fintech companies use proprietary software that competitors cannot simply copy
• Regulatory barriers: financial licenses, compliance requirements, and banking charters create significant entry barriers
• Contractual lock-in: customer agreements, minimum terms, and early termination fees raise switching costs
• Non-portable data: customer relationships, credit histories, and account data do not migrate at the click of a button

In crypto, even layer-2 networks and payment protocols can face competitive pressure from forks. However, protocols that build deep wallet integrations, developer tooling, and real-world partnerships create moats that are increasingly difficult to replicate. For example, Bitcoin layer-2 networks like Spark build defensibility through SDK integrations, institutional partnerships, and stablecoin infrastructure that cannot be replicated by simply forking code.

Risks and Considerations

For the Attacker

Vampire attacks carry significant risk for the attacking protocol. Token emissions used to attract liquidity dilute supply and create constant sell pressure. If the protocol fails to develop a sustainable fee model before emissions taper off, the same mercenary capital it attracted will leave for the next highest yield. The attacker can itself become the victim of a vampire attack by an even newer fork.

For the Target

Sudden liquidity loss increases slippage for traders, degrades user experience, and can trigger a negative feedback loop: higher slippage drives away volume, which reduces fees for remaining LPs, prompting further withdrawals. However, history shows that strong protocols with genuine innovation and community support can survive and even strengthen their position after an attack.

For Liquidity Providers

LPs chasing vampire attack rewards face impermanent loss on their positions, smart contract risk from unaudited fork contracts, and the possibility that the new protocol's token becomes worthless if the project fails. The governance tokens earned as rewards often decline sharply in value once the initial hype subsides and emissions inflation takes hold.

Ethical Considerations

Vampire attacks raise questions about open-source norms. While forking is a fundamental right in open-source software, specifically targeting another project's liquidity can be seen as parasitic. Proponents argue that competition benefits users through better incentives and innovation. Critics counter that it discourages teams from building in the open if their work can be trivially co-opted.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.