Forgotten, but not protected: hacker drains $2.1 million from the dead Aztec Connect protocol
On June 14, an incident occurred that once again reminded the community of the "dead contract problem." An attacker successfully targeted the Aztec Connect protocol, draining over $2.1 million from it. Notably, the project itself was shut down three years ago, and its developers no longer have administrative access or the ability to influence the situation.
Vulnerability in the Proof Verification Mechanism
My analysis of the transaction chain shows that the attack was made possible due to a critical flaw in the smart contract's verification logic. Specifically, the proof verification function correctly checked only the initial part of the data, while the token transfer instructions stored in another part of the transaction remained without proper oversight. This incomplete validation allowed the hacker to manipulate the withdrawal mechanism and, from the contract's perspective, legitimately steal the liquidity.
Team's Position: "We Are Powerless"
The Aztec Labs team confirmed the hack but immediately disclaimed responsibility for recovering the funds. In an official statement, it was emphasized that Aztec Connect is a deprecated protocol that has not been supported since 2022. The developers do not possess admin keys and cannot stop the contract's operation or deploy an update. They are conducting an investigation but are no longer able to influence the situation. It is important to note that the incident did not affect the current AZTEC token (ERC-20) or the active smart contracts of the Aztec mainnet.
Alarming Trend in June
This hack is the latest in a chain of attacks on "dead" or abandoned protocols. Just a few days earlier, hackers withdrew approximately $1.3 million from five outdated Raydium (RAY) liquidity pools on the Solana network. According to data from the DeFiLlama aggregator, total losses from hacker attacks in the first half of June alone have already exceeded $43.93 million.
Expert Commentary: This case is a classic example of a "time bomb" in DeFi. When a protocol shuts down, its contracts often remain on the blockchain, attracting the attention of malicious actors. The community and auditors need to develop standards for "burying" smart contracts, including forced disabling of key functions or complete self-destruction. Until this happens, such incidents will recur, causing damage even to those who have long left the project.