Attack on a dead protocol: hacker withdraws $2.1 million from long-closed Aztec Connect
On June 14, an attacker successfully exploited the Aztec Connect protocol, which had been shut down three years ago. The damage amounted to over $2.1 million in digital assets. This incident is a stark example of how "dead" smart contracts continue to pose risks to the ecosystem.
Security experts detected a suspicious transaction and quickly identified the attack vector. The vulnerability lay in incomplete proof verification. The key mechanism of the smart contract only checked the initial part of the provided data, while the token transfer instructions contained in another part remained without proper oversight. This allowed the hacker to substitute the withdrawal logic and legitimately, from the contract's perspective, withdraw nearly $2.19 million.
Ghost Protocol and Developer Stance
The Aztec Labs team confirmed the exploit but emphasized that they have no connection to the current state of the protocol. Aztec Connect was discontinued three years ago, and the developers do not possess administrative keys to manage or stop the contract.
"We cannot stop the system or update it. We have no control," Aztec Labs representatives stated. At the same time, they assured that the incident does not affect the current AZTEC token (ERC-20) and the active smart contracts of the Aztec mainnet. An investigation is underway, but the team is no longer able to influence the situation retroactively.
Alarming Trend in June
This hack occurred just a few days after an attack on outdated Raydium liquidity pools on the Solana network, where a hacker withdrew about $1.3 million. According to analysts, the total damage from DeFi hacks since the beginning of June has already exceeded $43.93 million. The attack on Aztec Connect is another link in this alarming chain, demonstrating that "forgotten" contracts remain an attractive target.
Cryptalist Comment: This case is a harsh reminder that in DeFi, there is no concept of a "statute of limitations." Any contract once deployed on the blockchain becomes eternal. Users should exercise extreme caution when interacting with outdated protocols, and project teams should implement mechanisms for "self-destruction" or contract locking after support is discontinued.