Deprecated Aztec Connect Loses $2.19M to Proof Verification Exploit Two Years After Full Wind-Down
An attacker drained roughly $2.19 million from Aztec Connect, a long-retired Ethereum privacy bridge, on June 14 by exploiting a gap between its zero-knowledge proof logic and its on-chain settlement code. The active Aztec Network and its AZTEC token were not affected.
At approximately 12:26 UTC on June 14, 2026, an attacker submitted seven crafted transactions to the RollupProcessorV3 smart contract, the backbone of Aztec Connect, a privacy-focused Layer 2 bridge that launched in July 2022, stopped accepting deposits in March 2023 after fewer than nine months of operation, and went fully dark by March 2024.
By the time the transactions settled, the contract had been emptied of 908.99 ETH (roughly $1.6 million), 270,513 DAI, 167.89 wstETH (roughly $357,000), and smaller amounts of several Yearn Finance yield tokens and LUSD. Total losses came to approximately $2.19 million.
What Broke and How
The exploit targeted a mismatch inside the contract's processRollup() function. When a user submitted a batch of transactions, two separate processes ran: one validated the zero-knowledge proof across the entire batch and recorded all transactions in the rollup's Merkle tree, while the other settled only a subset of transactions on Ethereum's base layer, determined by a parameter called numRealTxs. The attacker kept that parameter artificially low while inserting deposit records late in the batch where the proof verifier would count them but the settlement layer would ignore them. This created unbacked balances that the attacker then withdrew.
Security firms CertiK, BlockSec, and SlowMist each analyzed the exploit. CertiK described the flaw as a situation where one function checked only the beginning of the proof while "token transfer instructions embedded elsewhere went unverified." BlockSec confirmed that verified transactions were "not effectively bound to the transaction set enforced by the ZK proof." SlowMist documented the same boundary failure in a post titled "ZK-Rollup Settlement Boundary Bypass." In plain terms: the contract checked that the math was valid but did not confirm that the math covered the same transactions as the money movement.
This was not a break in zero-knowledge cryptography itself. ZK proofs as a mathematical tool were not compromised. The failure was a boundary error in legacy smart contract logic, a meaningful distinction for developers building on ZK-based infrastructure.
Immutable by Design, Vulnerable by Consequence
Aztec Foundation issued a statement after the incident, reported by CoinInsider: "Aztec Connect was deprecated 3 years ago. Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us." Team developer Param, also quoted by CoinInsider, confirmed the contracts were "fully immutable" after the wind-down.
This situation illustrates a structural tension in Ethereum development. When Aztec Labs shut down Aztec Connect, it renounced all admin keys as a commitment to trustlessness and censorship resistance, principles central to the protocol's design. Aztec Connect held Stage 2 rollup classification, the highest tier for decentralization. But those same properties meant nobody could intervene when residual user funds sat in the contract for more than two years after the sequencer went offline. Ethereum contracts do not expire on their own.
Token Markets Absorbed the News
The AZTEC token, which is linked to the current Aztec Network and has no connection to the exploited contracts, reached an all-time high of $0.038 in February 2026. At the time of the incident it was trading between $0.016 and $0.024, with a market cap of approximately $47 to $52 million and a circulating supply of around 2.95 billion tokens out of a 10.35 billion maximum. The token rose roughly 5% following disclosure of the exploit, a movement that suggested markets understood the incident was contained to a legacy product.
What This Means for Developers and Users in South Asia and Africa
The incident carries specific weight for Web3 builders and retail holders in India, Nigeria, Kenya, and Pakistan, among the most active developer markets for Ethereum L2 and ZK-based applications.
Teams in these regions often operate with smaller security budgets and fewer established audit relationships, a pattern consistently noted by audit firms working across the region. The Aztec Connect case is a direct example of lifecycle risk: a contract that passes every audit at launch can still become a liability years later if residual funds are not withdrawn before infrastructure goes offline.
India-based audit firm QuillAudits and regional security practitioners have flagged contract lifecycle management as a growing concern. For builders deploying DeFi infrastructure in South Asian and African markets, the lesson is concrete: deprecated contracts with unreclaimed funds require active remediation, not just a shutdown announcement.
For retail token holders in these regions, the communication challenge is acute. AZTEC is available on Coinbase, Kraken, and KuCoin, all of which have significant user bases across Africa and South Asia.
The incident also intersects with a meaningful economic reality for diaspora communities. Privacy-preserving bridges have found adoption along Africa-to-diaspora remittance corridors, particularly routes connecting Nigeria, Ghana, Kenya, and South Africa with communities abroad, where low-cost and private cross-border transfers address genuine financial needs. An exploit tied to a privacy bridge, even a retired one, adds friction to the public case for these tools at a moment when they serve practical cross-border payment purposes.
Investors without deep familiarity with Aztec's project history may struggle to separate the deprecated Aztec Connect bridge from the active Aztec Network platform. India's Financial Intelligence Unit and Nigeria's Securities and Exchange Commission have previously issued formal guidance flagging privacy-focused crypto tools, and Ghana's regulators have raised related concerns. An incident involving a privacy bridge, even a defunct one, could provide fuel for broader restrictions if the distinction between the two products is not communicated clearly in regional languages and forums.
Looking Ahead
The Aztec Connect exploit adds to a grim 2026 security ledger. More than $750 million had been lost to DeFi exploits by mid-April, and June had already recorded roughly $43.93 million in total crypto losses before this incident. The attack came days after a separate $1.3 million drain on Raydium.
The current Aztec Network continues development of its privacy-first L2 platform, which uses Noir, a Rust-like programming language for private smart contracts, and runs on a virtual machine separate from the EVM. That platform was not touched.
But the $2.19 million now gone from Aztec Connect is a reminder that deprecated infrastructure is not neutral infrastructure: as long as funds remain locked in an immutable contract, the attack surface remains open.