Developers of the privacy-focused Ethereum solution Aztec Network reported an attack on a deprecated smart contract, resulting in the extraction of approximately $2.1 million by the perpetrator.
We are investigating a potential exploit affecting Aztec Connect. ~$2.1m was transferred from the immutable smart contract in transaction:https://t.co/5WrfeR8bbJ
Aztec Connect was deprecated 3 years ago. Aztec Labs holds no admin keys or control over the system; it cannot be…
— Aztec Labs (@AztecLabs_) June 14, 2026
The incident affected the Aztec Connect platform, a solution for private transactions that ceased support in 2023. Despite the end of service, some funds remained locked in the protocol’s infrastructure.
The team assured that the current network and user assets were not impacted.
Experts from BlockSec linked the incident to a discrepancy between transaction verification and calculation in Ethereum. Due to differences in how the verification path and operation logic interpreted the transaction list, the contract could credit value without verification on the L1 blockchain.
ALERT! Our system detected a suspicious transaction targeting @aztecnetwork’s RollupProcessorV3 contract on #Ethereum hours ago, with estimated losses exceeding $2.15M.
Initial analysis suggests the root cause might be missing access control in processRollup(). Although the… pic.twitter.com/TdNkkNDfwX
— BlockSec Phalcon (@Phalcon_xyz) June 14, 2026
The attacker created unsecured balances and withdrew funds. The attack involved seven assets.
Certik listed the stolen assets as including 909 ETH, 270,000 DAI, 167 wstETH, and several other cryptocurrencies.
#CertiKInsight 🚨
We have detected a suspicious transaction that drained @aztecnetwork Router contract of ~$2.19M by 0x0f18d8b44a740272f0be4d08338d2b165b7edd17 on Ethereum.https://t.co/MizKXnEkTM
Stay Vigilant! pic.twitter.com/iUYMtenQYY
— CertiK Alert (@CertiKAlert) June 14, 2026
Aztec Connect was launched in 2022 as a DeFi bridge. In March 2023, the platform stopped accepting deposits, and the team shifted resources to Aztec Network.
Developers stated they do not have administrative keys and do not control the system, so they cannot pause or update it.
In November 2025, the project launched the L2 protocol Ignition Chain on Ethereum, positioning it as “the first fully decentralized layer-two solution.”
