Swerve Finance Governance Takeover

In 2023, the long-abandoned Curve fork Swerve Finance became the target of a governance takeover attempt. Swerve had been effectively unmaintained for years but still held locked funds and an active governance module. An attacker accumulated the dormant governance tokens needed to pass a proposal seizing control of the protocol's remaining ~$1.3M in locked assets, triggering a contested governance fight.

What happened

Swerve's governance had essentially no active community. An actor acquired enough of the abandoned SWRV governance tokens to pass arbitrary proposals, then proposed transferring control/funds. Remaining stakeholders and white-hats mounted a counter-governance response; the outcome was a partial, contested recovery.

Aftermath

• The takeover was partially resisted via counter-proposals; some funds preserved.
• Swerve remained effectively defunct.

Why it matters

Swerve Finance is the catalogue's clearest "abandoned protocol is an unguarded vault" case. A protocol nobody maintains but that still holds funds and has live governance is a standing target: governance with no active participants is governance an attacker can simply buy. The lesson generalises to the long tail of dead-but-deployed DeFi — Yearn iEarn, Mirror Protocol, Swerve: deprecation is not decommissioning. Funds and authority left on-chain in an unmaintained protocol remain attackable indefinitely, and "no one is working on it" is the vulnerability, not a mitigation.