Outdated Aztec smart contract drained of $2.1 million: a forgetfulness lesson for DeFi
Aztec Network, known for its privacy solutions on Ethereum, has faced an unpleasant incident: an attacker withdrew approximately $2.1 million from an outdated Aztec Connect smart contract. This is not just a routine attack — it is a stark reminder of how "dead" protocols can become targets for those who know how to wait.
The platform in question is Aztec Connect, which was deactivated back in 2023. Despite the cessation of support, locked funds remained in its infrastructure. The hacker exploited this by launching an attack involving seven different assets. Among the stolen funds are 909 ETH, 270,000 DAI, 167 wstETH, and other tokens, as confirmed by CertiK analysts.
How did it happen?
BlockSec experts point to a critical vulnerability in the transaction verification logic. The issue lies in a mismatch between how the contract validates operations and how it calculates them on the Ethereum mainnet. This allowed the attacker to create unbacked balances and withdraw funds without undergoing full verification on L1. This is a classic example of a "gap" between L2 logic and the underlying blockchain.
Notably, the Aztec team does not have administrative keys and cannot stop or update the contract. This is part of their decentralization philosophy, but in this case, it worked against them. The developers emphasize that the current Aztec Network and user assets are unaffected — the attack only targeted the "dead" code.
Aztec Connect was launched in 2022 as a DeFi bridge for private transactions but was shut down in 2023 in favor of the new L2 protocol Ignition Chain, which is positioned as "the first fully decentralized second-layer solution" on Ethereum.
My expert commentary: This incident is a harsh reminder for the entire industry. "Dead" contracts are time bombs. Even if a project is outdated, the funds within it do not magically disappear. Teams should either implement fund withdrawal mechanisms (e.g., through temporary multisigs) or publish clear instructions for users. And hackers, as always, show that there is no room for "dormant" assets in DeFi.