A vulnerability in the outdated Aztec Connect smart contract cost $2.1 million: incident analysis
The crypto community has recorded another attack on outdated infrastructure. This time, the target was the Aztec Connect platform — a privacy transaction solution based on Ethereum, support for which was discontinued three years ago. As a result of the hack, the attacker withdrew approximately $2.1 million from an unupgradable smart contract.
The incident affected exclusively the outdated Aztec Connect contract, which was deactivated by developers back in 2023. It is important to emphasize that the current Aztec Network and the assets of users interacting with the new protocol remained untouched. The Aztec Labs team does not have administrative keys to the old contract, making it impossible to pause or upgrade it — this is a classic example of the risk of "abandoned" smart contracts.
Technical Details of the Attack
Security specialists from BlockSec and CertiK conducted an initial analysis of the transaction. The root of the problem lies in a mismatch between the verification of transactions at the contract level and their settlement on the Ethereum mainnet. Due to differences in how the verification path and operational logic interpreted the transaction list, the contract could credit value without proper verification on the L1 blockchain. The hacker exploited this vulnerability by creating unbacked balances and instantly withdrawing funds across seven different assets.
According to CertiK, the stolen assets included 909 ETH, 270,000 DAI, 167 wstETH, and a number of other cryptocurrencies. The attack was carried out through the processRollup() function, where proper access control verification was missing.
Context and Lessons
Aztec Connect was launched in 2022 as a DeFi bridge for private transactions, but in March 2023, developers stopped accepting deposits, shifting resources to create a new generation L2 solution — Aztec Network. In November 2025, the project launched the Ignition Chain protocol, which is positioned as the "first fully decentralized second-layer solution" on Ethereum.
My professional opinion: This incident is a stark reminder that outdated smart contracts represent a "time bomb." Even if a protocol is officially shut down, residual funds in unupgradable contracts become easy prey for attackers, especially when there is no emergency stop mechanism. Investors and teams should prioritize liquidity migration procedures and the complete liquidation of old contracts to avoid such losses.