You've Seen the Term. Here's What It Actually Means
You spent six months building a popular farmers' market. Stalls, regulars, a reputation earned slowly. Then one morning a competitor sets up directly outside your gates, offering every vendor a cut of ownership just to move their tables fifty feet. That's not imitation. That's a vampire attack.
A standard DeFi fork copies code. A vampire attack copies code and then systematically drains the original protocol's liquidity by paying users to leave. The distinction sounds subtle. The consequences are not.
What a Plain Fork Actually Does
Forking an open-source DeFi protocol is, in technical terms, boring. You take the audited code from a public repository, deploy it to a new set of contracts, maybe tweak a fee parameter or rebrand the UI, and you're live. The original protocol keeps running. Its liquidity providers stay put. Its trading volume continues. The fork competes on reputation and features, not on actively stripping assets from the source.
Compound has been forked dozens of times. Uniswap v2's code has been deployed on practically every EVM-compatible chain under a different name. Most of those forks are quiet competitors at best, abandoned contracts at worst. They don't threaten the original because they offer no specific reason for an existing user to migrate.
The fork is a photocopy. Sometimes useful, usually unremarkable.
The Mechanism That Makes a Vampire Attack Different
A vampire attack adds one critical ingredient: a token-based incentive aimed directly at the incumbent's liquidity providers.
Here's how the sequence actually runs. The attacker forks the protocol. They issue a new governance or reward token. They then allow liquidity providers from the original protocol to stake their existing LP tokens on the new platform and earn the new token as yield. That yield is calibrated to be dramatically higher than whatever the original protocol offers, at least in the early weeks.
The liquidity provider's calculation becomes simple. They can earn, say, 40% APR in new tokens by moving, versus 8% in fees by staying. Rational actors move. As liquidity leaves the original protocol, its depth thins, slippage rises for traders, volume migrates to follow the liquidity, and fee revenue falls further. It's a self-reinforcing drain. Hence the name.
The SushiSwap attack on Uniswap is the canonical case. SushiSwap launched with a "migration" mechanism: Uniswap LP token holders staked on SushiSwap, earned SUSHI rewards, and after a set period the contract automatically withdrew the underlying assets from Uniswap and redeployed them into SushiSwap pools. At its peak, over $1 billion in liquidity migrated in roughly two weeks. Uniswap survived, partly because it then launched its own UNI token, but the episode defined what a vampire attack looks like in practice.
The Three Structural Differences, Precisely
If you want a clean taxonomy, it comes down to three things.
Targeting. A fork competes passively. A vampire attack actively targets the incumbent's user base with instruments designed specifically to pull those users away. The LP token staking mechanic in SushiSwap wasn't incidental. It was the entire strategy.
Token emissions as a weapon. Forks may or may not have tokens. Vampire attacks require them, because the token is the mechanism of extraction. The attacker is essentially paying for liquidity with future inflation. Whether that's sustainable is a separate question, but the token is load-bearing in the attack design.
Time sensitivity. A fork can sit quietly and grow over years. A vampire attack depends on a concentrated burst of incentives before the incumbent responds. The window is measured in weeks, not quarters. Once the target protocol adapts, by issuing its own token, matching yields, or building lock-ups, the attack loses its edge. Speed is structural, not incidental.
What People Get Wrong About Who "Wins"
The folk narrative is that vampire attacks are zero-sum: SushiSwap wins, Uniswap loses. The reality is messier. This is the part most guides skip, and skipping it is a mistake.
Liquidity that migrates for pure yield incentives is mercenary liquidity. Full stop. It leaves again the moment a better yield appears elsewhere. SushiSwap's liquidity base proved volatile in exactly this way in the months after its launch. Meanwhile, Uniswap's stickier, fee-motivated liquidity returned as the token emission frenzy cooled.
There's also the attacker's bootstrapping problem. Paying 40% APR in your own token works while the token has value. But token value depends on the protocol having genuine usage. If the vampire attack succeeds in draining liquidity but the attacker's protocol doesn't develop organic volume, the token price collapses, the APR in dollar terms craters, and the mercenary liquidity exits. You've successfully hurt your competitor and quietly hurt yourself in the same motion.
Consider two liquidity providers: Priya, who migrated early and sold her SUSHI rewards at peak prices, and Marcus, who migrated late and held. Priya made the vampire attack work for her. Marcus donated capital to the process. Same attack, very different outcomes depending entirely on timing and behavior. The attack creates winners and losers even among the people it's supposedly rewarding.
So ask yourself: which one are you more likely to be, given when you typically hear about these things?
The Honest Caveat About Protocol Resilience
Not every protocol is equally vulnerable. Vampire attacks work best against protocols where liquidity is mobile and the primary loyalty is yield. Uniswap had no token at the time of the SushiSwap attack, so it had no direct counter-incentive to offer. That's a specific, exploitable vulnerability.
Protocols with deep lock-ups, veToken mechanics (where governance tokens are locked for years to earn boosted rewards), or strong brand loyalty are structurally harder to drain. Curve Finance's vote-escrow model creates lock-up periods of up to four years. You can fork Curve's code in an afternoon. Convincing someone to abandon a four-year lock-up requires considerably more than a two-week emission spike.
The attack also requires the target to be large enough to be worth attacking but not so entrenched that migration is socially costly. There's a sweet spot, and it narrows as DeFi protocols mature and add stickiness mechanisms precisely because of SushiSwap's precedent.
The better question isn't whether a given protocol could be vampire attacked. Almost any AMM technically could. The real question is how much of its liquidity would actually move, and at what yield premium. That's a function of lock-up design, user composition, and brand trust. Protocols that have thought carefully about this are genuinely more resilient than the 2020 vintage.
A fork is a photocopy. A vampire attack is a photocopy with a straw inserted directly into the original's veins. The code might be identical. The intent, the mechanism, and the aftermath are not, and conflating them is how you misread every attack that follows.