A vampire attack is when a new protocol drains liquidity and users away from an established competitor by paying token incentives to whoever migrates. The attacker typically forks the target’s open-source code, launches a governance token the original does not have, and rewards users for moving their capital across. The tactic is named for what it does: draining the lifeblood of a protocol rather than competing on product. SushiSwap’s assault on Uniswap in September 2020 is the canonical case, and the pattern has repeated across DEXes, NFT marketplaces and launchpads ever since.
Key Facts
- SushiSwap launched 28 August 2020 as a fork of Uniswap with an added governance token.
- It rewarded users for staking Uniswap LP tokens, then migrated roughly a billion dollars of liquidity in September 2020.
- Uniswap responded on 16 September 2020 with the UNI airdrop, granting 400 UNI to every past user.
- Blur ran the same playbook against OpenSea from late 2022, using airdrops, zero fees and optional royalties.
- Vampire attacks only work against protocols with forkable code and no token of their own.
- Mercenary liquidity is the standard failure mode — capital arrives for incentives and leaves when they stop.
- The defence that works is issuing a token to existing users before an attacker does it for you.
How the Attack Is Constructed
The mechanism has four steps and they are almost always the same. Fork the target’s contracts, since the code is open source and copying it is legal and free. Launch a token the target does not have, giving you something to pay with that costs nothing to mint. Reward users for depositing the target’s LP tokens — capital that is already committed and easy to identify. Then, once enough is staked, migrate all of it into your own pools in a single coordinated move.
Step three is the clever part. The attacker does not need users to withdraw anything first; they simply stake the receipt tokens they already hold, which feels low-commitment. By the time the migration executes, the liquidity has effectively already changed hands. Everything about it depends on liquidity being mobile and permissionless, which is the same property that makes DeFi work in the first place.
The Two Cases Everyone Cites
| SushiSwap vs Uniswap, 2020 | Blur vs OpenSea, 2022-23 | |
|---|---|---|
| Target’s weakness | No token for users | High fees, enforced royalties |
| Incentive offered | SUSHI rewards for staking LP tokens | Airdrops for listing and bidding |
| Result | ~$1B liquidity migrated | Overtook OpenSea in trading volume |
| Defender’s response | UNI airdrop to all past users | Fee cuts and royalty changes |
| Outcome long-term | Uniswap retained leadership | Market fragmented, both diminished |
The last row is the part that gets left out of the story. SushiSwap won the raid and lost the war — Uniswap’s UNI airdrop, 400 tokens to every historical user, converted a defensive scramble into the most effective retention event in DeFi history, and Uniswap remained dominant. Blur genuinely displaced OpenSea in volume terms, but the resulting race to zero fees damaged the economics for everyone including Blur.
Why Most Vampire Attacks Fail
Incentivised liquidity is rented, not owned. Capital that arrived because you were paying it 300% APY leaves the moment the emissions taper, and the attacker is left with an inflated token supply, a collapsed price and pools drained back to where they came from. The attack succeeds at the moment of migration and fails over the following quarter unless something else was built in the meantime.
The rare successes convert borrowed liquidity into genuine advantage before the incentives run out — better execution, lower fees, a product reason to stay. That is a much harder problem than the raid itself, and most attackers never solve it. Current liquidity across competing protocols is trackable on DefiLlama, where the pattern is visible as a spike followed by decay in almost every case.
Where the Tactic Shows Up on Solana
Solana’s version is mostly launchpad competition rather than classic LP migration. Rival platforms court creators and traders with fee rebates, revenue sharing and token rewards, aiming to pull volume away from an incumbent — the same economics, applied to flow instead of deposits. Aggregators complicate it further, because routing through an aggregator rather than a specific venue means liquidity is already being pulled toward wherever prices are best, continuously, without anyone declaring an attack. Pair-level volume shifts are visible on DEXScreener long before they are announced as strategy.
Why a Memecoin Cannot Be Vampire Attacked
DOLAN Duck ($DOLAN) is a token, not a protocol — a fixed 98.3M supply held across roughly 10,700 wallets, with no fee revenue, no LP staking programme and no user base that can be paid to migrate somewhere else. There is nothing to fork, because there is no code beyond the shared SPL Token Program. What can be attacked is the liquidity pool a token trades in, if incentives pull market makers elsewhere, and that risk exists identically for every memecoin on Solana. The practical implication is narrow: for tokens, vampire attacks are a venue-level concern rather than an existential one, and the thing worth watching is whether liquidity depth in the pool you trade against is stable — which you should be checking anyway before routing any swap through an aggregator.
A vampire attack is when a new protocol drains liquidity and users from an established competitor by offering token incentives to migrate, usually after forking the target’s open-source code.
SushiSwap forked Uniswap in August 2020 and rewarded users with SUSHI for staking their Uniswap LP tokens, then migrated roughly a billion dollars of liquidity into its own pools in September.
With the UNI airdrop on 16 September 2020, granting 400 UNI to every past user. It removed the attacker’s main advantage — having a token when the incumbent did not — and Uniswap kept its lead.
Because incentivised liquidity is rented. Capital that arrived for high emissions leaves when they taper, leaving the attacker with an inflated token supply and pools draining back to the original protocol.
Blur used airdrops, zero fees and optional royalties to pull NFT trading volume from OpenSea starting in late 2022, and overtook it in volume — though the resulting fee war damaged both platforms’ economics.
No. A memecoin has no code to fork, no fee revenue and no staking programme, so there is nothing to drain. Only the liquidity pool it trades in can be affected, which is a venue-level risk shared by all tokens.
Issue a token to existing users before an attacker can offer one. Uniswap’s retroactive airdrop is the template, and it works because it rewards loyalty the attacker cannot retroactively match.