A new protocol launches, offers much higher rewards than the one everyone already uses, and within weeks a large share of the original protocol's liquidity has moved over. In DeFi this pattern has a name: a vampire attack. It is not a hack or a scam in the usual sense. It is a competitive strategy built entirely out of token incentives, and understanding how it works helps explain why some pools suddenly offer rewards that look too good relative to an established alternative.
The mechanism
A vampire attack usually starts with a fork. A new team copies the code of a working, trusted protocol, often down to the exact pool logic, and launches it with one key difference: a new token paid out generously to anyone who provides liquidity. Because the new protocol is a close copy, it already does what the original does, so a liquidity provider does not need to learn a new interface or take on unfamiliar smart contract risk to switch. The only real difference on offer is the reward rate.
To make the migration frictionless, the new protocol often builds a mechanism that lets users deposit their LP tokens from the original protocol directly, converting that position into the fork's own pools without needing to withdraw to the underlying assets first. The incentive is simple: for as long as the fork pays out a richer reward in its own token, capital has a reason to move, and the fork's total liquidity grows at the original protocol's expense.
Where the name and the model come from
The term became widely known in August 2020, when a protocol called SushiSwap forked Uniswap's code and launched its own SUSHI token as a liquidity mining reward. SushiSwap's early rewards went specifically to people who deposited Uniswap LP tokens, which were then converted into SushiSwap liquidity. Liquidity moving into Uniswap grew rapidly at the time, and SushiSwap ended up holding a large share of it, worth hundreds of millions of dollars, within days of launch. Shortly after, the pseudonymous developer behind the project sold off a large personal token allocation and handed control to a centralized exchange operator, which shook confidence in the project for a period. Uniswap continued operating throughout and remains one of the largest decentralized exchanges today. (See our guide on what Uniswap is and how it works on Base.)
That episode is why "vampire attack" entered the DeFi vocabulary, but the mechanism it describes, forking a protocol and out-bidding it on liquidity rewards, did not end there. Variations of it have shown up repeatedly across chains and cycles whenever a new DEX or lending market wants to bootstrap liquidity quickly instead of waiting for it to arrive organically.
Why a protocol would want to do this
Liquidity is the hardest thing for a new DeFi protocol to earn. Deep liquidity means lower slippage and better prices, which attracts traders, which generates fees, which in turn makes liquidity providing worthwhile on its own merits. Until a pool reaches that point, it is an unproven place to lock up capital. Paying a temporary, token-funded premium is a way to shortcut that bootstrapping period by pulling in capital, and reputation by association, from somewhere it already exists. Our guide on yield farming and liquidity mining covers the broader mechanics of paying LPs in a project's own token, which is the same tool a vampire attack applies more aggressively and competitively.
The tradeoff an LP is actually taking
An advertised reward rate in a vampire attack is paid in a brand new token, usually one with no trading history and a supply schedule set entirely by the new team. If demand for that token falls as emissions continue, which is a common pattern for freshly launched reward tokens, the real return can end up far below the advertised rate even while the nominal token amount paid out matches what was promised. Moving liquidity also means trusting a new, unaudited or lightly audited codebase over one with a longer track record, and migrating back later usually means paying gas and accepting slippage twice. See our guide on liquidity pools and impermanent loss for how a pool's underlying mechanics affect what an LP actually keeps, independent of any reward layer on top.
None of this makes a new protocol automatically untrustworthy. Plenty of forks have gone on to become legitimate, long running platforms in their own right. The reward rate itself is just not a reliable signal of which outcome you are looking at.
Questions worth asking before moving liquidity
A few checks separate a reasonable migration from a trap built on an unsustainable reward:
- Where does the reward token's value come from? A token with no fee revenue, no real utility, and an emissions schedule that only increases supply is relying entirely on continued buying pressure to hold its price.
- Has the contract been audited, and by whom? A fork of audited code is not automatically safe. Even small, deliberate changes to the original logic can introduce new risk that the original audit never covered.
- What happens to the reward rate over time? Many protocols advertise their highest rate on day one, before emissions schedules start tapering or total value locked grows enough to dilute the per-dollar reward.
- Who controls the contract? The same ownership checks that matter for any new token apply here. See our guide on token owner privileges: mint, pause, blacklist explained.
The takeaway
A vampire attack is a liquidity war fought with token incentives rather than code exploits. It works because moving capital between near-identical pools is easy, and a high enough reward rate can make that move look obviously worthwhile in the short term. The part that actually determines whether it was worthwhile is what happens to the reward token's value after the migration, not the percentage advertised on launch day.