An outdated Aztec smart contract cost $2.1 million: a hacker exploited a gap in verification logic
Developers of the private Ethereum solution Aztec Network have confirmed the exploitation of an outdated smart contract. The attacker withdrew approximately $2.1 million from infrastructure that was officially decommissioned three years ago.
Incident Details
The attack affected the Aztec Connect platform, a solution for confidential transactions whose support ended in 2023. Despite deactivation, some funds remained locked in the protocol. The team emphasized that the project's current network and user assets were not affected.
According to an analysis by BlockSec experts, the root cause is a mismatch between transaction verification and their final settlement on Ethereum. Due to differences in the interpretation of the transaction list between the verification path and operational logic, the contract credited value without verification on the L1 blockchain. The hacker created unbacked balances and withdrew funds across seven assets.
Losses and Scale
Certik specialists detailed the stolen assets: 909 ETH, 270,000 DAI, 167 wstETH, and several other cryptocurrencies. The attack was carried out through the RollupProcessorV3 contract, which, despite deactivation, remained on the Ethereum network.
Aztec Connect was launched in 2022 as a DeFi bridge. In March 2023, the platform stopped accepting deposits, and the team redirected resources to Aztec Network. Developers stated they do not have administrative keys and do not control the system, so they cannot pause or update it. As a reminder, in November 2025, the project launched the Ignition Chain L2 protocol on Ethereum, positioning it as "the first fully decentralized second-layer solution."
My analysis: This case is a classic example of risks associated with "dead" contracts. Even after support ends, smart contracts remain part of the blockchain, and if they contain vulnerabilities, attackers will eventually find them. The incident highlights the need for proactive auditing of legacy code and the development of mechanisms for automatically freezing such assets.