Hack from the Past: Hacker Withdraws $2.1M from Long-Closed Aztec Connect Protocol
The crypto community has once again faced a troubling reminder that "dead" smart contracts can harbor a deadly threat. On June 14, an attacker successfully targeted the Aztec Connect platform, which was officially shut down three years ago, and stole over $2.1 million.
The incident was flagged by security experts at CertiK. They noticed a suspicious transaction and promptly alerted the public. The root cause of the hack lies in a fundamental flaw in the proof verification mechanism within the smart contract. The system only checked the initial part of the provided data, leaving instructions for token transfers without proper oversight. This loophole allowed the hacker to manipulate the withdrawal logic and drain the protocol.
Aztec team's response: "We are powerless"
The Aztec Foundation confirmed receiving a notification about a potential exploit. In their statement, the team emphasized that the hack solely affected the old Aztec Connect infrastructure, which is unrelated to the current AZTEC token (ERC-20) or the active contracts of the Aztec network. The key point is that developers no longer control this protocol. "Aztec Labs has no administrative keys, and we cannot stop the system or update it," project representatives stated, effectively acknowledging their inability to influence the situation.
This case is not an isolated one. Just a few days earlier, hackers withdrew approximately $1.3 million from five outdated liquidity pools on Solana (the Raydium project). According to DeFiLlama, the total damage from hacks in the first half of June alone has already exceeded $43.93 million.
My comment as an analyst: This incident is a stark example of a "time bomb" in DeFi. Developers, when exiting the market, often leave behind "forgotten" contracts with vulnerabilities that will eventually be discovered. Investors should take a lesson: funds locked in inactive protocols are not a "safe vault" but a potential target. The Aztec Connect story is a harsh reminder that there is no room for complacency in cryptocurrencies, even if a project is declared dead.