Aztec has been hit by another security incident after an attacker exploited its deprecated Private Rollup Bridge, draining approximately $2.15 million worth of crypto assets. The incident comes less than a week after a separate exploit targeted Aztec Connect, raising fresh concerns about the risks posed by legacy smart contracts that remain active on chain.
Security researchers from SlowMist and other blockchain security firms traced the exploit to the bridge’s emergency withdrawal mechanism, which allegedly allowed an attacker to manipulate proof data and withdraw funds that should not have been released.
Second Exploit Hits Aztec Within Days
The latest attack targeted Aztec’s Private Rollup Bridge, a privacy-focused infrastructure product launched in 2021 and deprecated in 2022. Although the product was shut down years ago, its smart contracts remained operational because they were designed as immutable contracts that cannot be altered or upgraded.
According to security researchers, the attacker successfully drained approximately:
- 1,158 ETH
- 150,000 DAI
- Around 0.47 to 0.5 renBTC
The total value of the stolen assets was estimated at roughly $2.15 million to $2.16 million at the time of the exploit.
Researchers also noted that the wallet used in the exploit was initially funded with a small amount of ETH originating from crypto exchange HitBTC before the attack was executed.
How the Attack Worked?
Preliminary investigations from SlowMist, including analysis shared by co-founder Cos and founder Yu Xian, suggest the attacker exploited weaknesses within the bridge’s escapeHatch function.
The escape hatch was originally designed as an emergency tool that allowed users to withdraw assets directly from Ethereum if needed. However, researchers found that the function lacked critical verification checks.
According to the findings, the attacker was able to submit a false rollup proof and manipulate withdrawal-related parameters. The contract reportedly trusted specific transaction inputs without independently verifying ownership of the funds being withdrawn.
During brief periods when the escape mechanism was active, the attacker allegedly tricked the contract into releasing assets held by the bridge’s infrastructure.
Security firm BlockSec later said that both the recent Private Rollup Bridge exploit and the earlier Aztec Connect exploit were linked to what it described as public input binding issues, although the attack methods were not identical.
Aztec Says Current Network Remains Unaffected
Following the exploit, Aztec Labs emphasized that the compromised infrastructure is unrelated to the current Aztec Network or the AZTEC token.
The company explained that the affected bridge was deprecated years ago and operates as an immutable system. Because of its design, the team does not possess administrative keys and cannot pause transactions, upgrade the contracts, or directly intervene once vulnerabilities are discovered.
Aztec Labs also stressed that the incident is entirely separate from the current generation of network infrastructure under development.
The latest exploit follows another attack discovered on June 14 involving Aztec Connect, a privacy-focused rollup product that had already been deprecated in March 2023. That incident resulted in losses exceeding $2.1 million.
Legacy Smart Contracts Under Fresh Scrutiny
The back-to-back exploits have renewed debate around the security risks posed by deprecated smart contracts that continue to hold user assets.
Risk analysis platform Blockful warned that old smart contracts can effectively become ongoing targets for hackers when active maintenance and oversight end.
Security experts argue that even when protocols discontinue products, immutable contracts containing legacy funds may continue to present attractive attack opportunities. SlowMist recommended that projects carrying assets in deprecated contracts consider structured asset migration plans to reduce long-term exposure.
The incident also adds to a growing list of bridge-related security breaches across the crypto industry. Reports indicate that bridge exploits have already caused more than $340 million in losses this year alone, highlighting the continued challenges facing decentralized finance security.