A vulnerability in the abandoned Aztec Connect contract resulted in a loss of $2.1 million: a detailed analysis of the incident
Today, I received a signal about a serious incident in the Aztec Network ecosystem. An attacker managed to withdraw approximately $2.1 million from an outdated smart contract of the Aztec Connect platform — a solution for private transactions that was deactivated back in 2023. The attack affected an immutable contract that could not be updated, making it impossible to protect the funds.
How did the attack happen?
According to my analysis, the root of the problem lies in a mismatch between the transaction verification logic and their final settlement at the Ethereum (L1) level. BlockSec experts have already pointed out that due to differences in the interpretation of the transaction list, the contract could credit funds without proper verification on the mainnet. The attacker exploited this by creating unbacked balances and withdrawing funds across seven different assets.
What was stolen?
Data from Certik confirms the scale: among the stolen assets are 909 ETH, 270,000 DAI, 167 wstETH, and a number of other tokens. It is important to emphasize that the attack was aimed exclusively at the old Aztec Connect infrastructure, which has not accepted deposits since March 2023. The Aztec Labs team assured that the project's current network and user funds within it were not affected.
Why did this happen now?
Aztec Connect was launched in 2022 as a DeFi bridge for private operations. After its deactivation, the team fully redirected resources to developing the new L2 protocol Ignition Chain, which was launched on the Ethereum mainnet in November 2025. The key point: developers do not have administrative keys to the old contracts and cannot stop or update them. This is a classic example of the "dead code" risk, where abandoned but still active contracts become targets for hackers.
My expert conclusion
This incident serves as a harsh reminder for the entire industry. Even if a protocol has ceased operations, funds remaining in immutable contracts remain vulnerable. Teams need to provide mechanisms for the safe withdrawal of liquidity upon deactivation, and users should promptly withdraw assets from outdated versions. In this case, the attacker simply exploited a "dormant" vulnerability that no one could fix. This is another argument in favor of more thorough auditing of lifecycle processes in DeFi.