2026

Connect

Tornado Cash

Aztec

Humanity

<p>Aztec Connect, a deprecated DeFi bridge linked to the privacy-focused Aztec ecosystem, was exploited on Sunday after an attacker drained about $2.1 million from an old Ethereum smart contract.</p>
<div id="cn-block-summary-block_814e33fc4ae0d9b453f885cd42a03388" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Aztec Connect’s old contract lost $2.1m, while the current Aztec Network stayed unaffected, Aztec said.</li>
   <li>The attack used a verification mismatch, letting unbacked balances move through settlement on Ethereum records.</li>
   <li>DeFiLlama data shows June already has several hacks, led by Humanity Protocol and Syscoin losses.</li>
  </ul>
 </div>
</div>
<p>Aztec Labs said on X that it was “investigating a potential exploit affecting Aztec Connect.” The team said about $2.1 million had moved from the platform’s immutable contract, but added that current Aztec Network users and assets were not affected.</p>
<p>The statement drew attention because Aztec Connect was no longer an active product. The platform was deprecated in March 2023 after Aztec Labs shifted work to the next version of its privacy network.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>We are investigating a potential exploit affecting Aztec Connect. ~$2.1m was transferred from the immutable smart contract in transaction:<a href="https://t.co/5WrfeR8bbJ" rel="noopener noreferrer nofollow">https://t.co/5WrfeR8bbJ</a><br><br>Aztec Connect was deprecated 3 years ago. Aztec Labs holds no admin keys or control over the system; it cannot be…</p>— Aztec Labs (@AztecLabs_) <a href="https://x.com/AztecLabs_/status/2066175340926345555?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 14, 2026</a>
  </blockquote>
 </div>
</figure>
<p>You might also like: <a href="https://crypto.news/cardanos-1096-btc-dispute-grows-after-hoskinson-ama/" rel="noopener noreferrer nofollow"> Cardano’s 1,096 BTC dispute grows after Hoskinson AMA </a></p>
<h2 class="wp-block-heading" id="strong-old-aztec-connect-funds-stayed-in-the-contract-strong"><strong>Old Aztec Connect funds stayed in the contract</strong></h2>
<p>Aztec Connect had once allowed users to access DeFi through a privacy-focused ZK rollup. Deposits were halted when the system was phased out, and users had time to withdraw their funds from the old platform.</p>
<p>Some assets remained in the contract. Crypto developer Param said the contracts later became “fully immutable” and could no longer be upgraded or paused. Aztec Labs also said it holds no admin keys or control over the old system.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>How $2.1M got drained from Aztec Connect:<br><br>– Aztec Connect was a privacy based zkRollup on Ethereum<br><br>– Aztec Labs shut it down in 2023 to focus on newer tech<br><br>– Users were given over a year to withdraw their funds<br><br>– In 2024, Aztec gave up control of the system and removed admin… <a href="https://t.co/O0WiYOI4nY" rel="noopener noreferrer nofollow">pic.twitter.com/O0WiYOI4nY</a></p>— Param (@Param_eth) <a href="https://x.com/Param_eth/status/2066198088168227031?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 14, 2026</a>
  </blockquote>
 </div>
</figure>
<p>Unlike a live protocol, the old Aztec Connect system had no operator able to pause activity. That made the response depend on public warnings, tracing, and checks by remaining affected users online.</p>
<p>That setup left no simple way to stop the exploit once the attacker found the path. The old code still lived on Ethereum, and the contract still held funds, even though the product had been abandoned.</p>
<h2 class="wp-block-heading" id="strong-security-firms-explain-the-attack-strong"><strong>Security firms explain the attack</strong></h2>
<p>BlockSec’s Phalcon team <a href="https://x.com/Phalcon_xyz/status/2066372401198502083" rel="noopener noreferrer nofollow">said</a> the attack targeted Aztec Connect’s RollupProcessorV3 contract on Ethereum. The firm said losses exceeded $2.15 million after suspicious activity hit the contract.</p>
<p>According to BlockSec, the issue involved a mismatch between how transactions were verified and how they were settled on Ethereum. In simple terms, the proof system and the settlement logic did not read the transaction list in the same way.</p>
<p>That gap allowed the attacker to create balances that were not backed by valid value on Ethereum. The attacker then withdrew those balances. The same pattern was repeated seven times across several assets.</p>
<p>CertiK data shared on X listed the stolen assets as including 909 ETH, around 270,000 DAI, 167 wrapped staked ETH, and smaller amounts of other tokens. Param also said the attacker funded the wallet through Tornado Cash before the exploit.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p><a href="https://x.com/hashtag/CertiKInsight?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#CertiKInsight</a> 🚨<br><br>We have detected a suspicious transaction that drained <a href="https://x.com/aztecnetwork?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@aztecnetwork</a> Router contract of ~$2.19M by 0x0f18d8b44a740272f0be4d08338d2b165b7edd17 on Ethereum.<a href="https://t.co/MizKXnEkTM" rel="noopener noreferrer nofollow">https://t.co/MizKXnEkTM</a><br><br>Stay Vigilant! <a href="https://t.co/iUYMtenQYY" rel="noopener noreferrer nofollow">pic.twitter.com/iUYMtenQYY</a></p>— CertiK <a href="https://x.com/CertiKAlert/status/2066156825666543871?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 14, 2026</a>
  </blockquote>
 </div>
</figure>
<h2 class="wp-block-heading" id="strong-june-hack-losses-keep-rising-strong"><strong>June hack losses keep rising</strong></h2>
<p>The Aztec Connect exploit adds to another active month for DeFi security incidents. DeFiLlama’s hacks tracker <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">shows</a> several June losses, including $30 million from Humanity Protocol on June 8 and $8 million from <a href="https://crypto.news/syscoin-bridge-paused-after-5b-sys-unauthorized-output/" rel="noopener noreferrer nofollow">Syscoin Bridge</a> on June 7.</p>
<p>As previously <a href="https://crypto.news/humanity-protocol-says-compromised-admin-keys-led-to-36m-exploit/" rel="noopener noreferrer nofollow">reported</a> by crypto.news, Humanity Protocol said more than $36 million was stolen after attackers compromised administrative keys linked to its bridge infrastructure across Ethereum and BNB Smart Chain.</p>
<p>Crypto.news also reported that hack <a href="https://crypto.news/crypto-hack-losses-drop-90-to-68-3m-in-may-certik-says/" rel="noopener noreferrer nofollow">losses fell to $68.3 million in May</a>, down nearly 90% from April. Still, CertiK said code flaws caused about $45 million of May’s losses, making them the largest attack path for that month.</p>
<p>The Aztec case shows why old DeFi contracts remain part of the security map. Even when a product is discontinued, any funds left in immutable contracts can still draw attackers years later.</p>
<p>Read more: <a href="https://crypto.news/mica-deadline-75-of-eu-crypto-firms-may-lose-licenses-on-july-1/" rel="noopener noreferrer nofollow"> MiCA deadline: 75% of EU crypto firms may lose licenses on July 1 </a></p>

Aztec Connect loses $2.1m after old contract exploit

Table of Contents

crypto.news

Other articles published on Jun 15, 2026

Join our free newsletter for daily crypto updates!