Connect

DeFi

Aztec

Syscoin

Aztec Connect, a deprecated decentralized finance platform, was drained of around $2.1 million in crypto on Sunday after an attacker exploited its verification function.
Aztec Labs <a href="https://x.com/AztecLabs_/status/2066175340926345555" rel="noopener noreferrer nofollow">posted</a> to X on Sunday that it was “investigating a potential exploit affecting Aztec Connect,” adding that around $2.1 million was transferred from the platform’s smart contract, which did not affect users or assets on the current Aztec network.
The exploit is the latest in the $44 million worth of crypto that has been stolen so far this month from at least 12 other exploits, <a href="https://defillama.com/hacks" rel="noopener noreferrer nofollow">according</a> to DeFiLlama.&nbsp;
A private key compromise on the Humanity Protocol has been the largest so far in June, with <a href="https://cointelegraph.com/news/humanity-h-token-tanks-85-following-30m-private-key-compromise" rel="noopener noreferrer nofollow">$30 million lost</a> on June 8, followed by the Syscoin Bridge, which saw $8 million swiped in a fake proof exploit the previous day.
Crypto security firm BlockSec <a href="https://x.com/Phalcon_xyz/status/2066372401198502083" rel="noopener noreferrer nofollow">said</a> that an attacker exploited a mismatch in how the platform verified transactions and settled them on Ethereum.
It said that verified transactions on Aztec Connect’s contract were “not effectively bound to the transaction set enforced by the ZK proof,” allowing its verification path and settlement logic on Ethereum “to interpret the transaction list differently.”
The attacker could then place transactions where the contract credited value without validating it on Ethereum, which created unbacked balances that could then be withdrawn. The attacker did this seven times across seven different assets.
The attacker made off with 909 Ether (ETH), 270,000 Dai (DAI), 167 of wrapped staked ETH and a handful of other cryptocurrencies.
<img alt="Aztec Connect’s abandoned smart contract exploited for $2.1M" height="348" src="https://s3-images.ctmedia.io/media/content/pasted-image-315.jpeg" width="1083">Some of the assets stolen in the exploit. Source: <a href="https://x.com/CertiKAlert/status/2066156825666543871" rel="noopener noreferrer nofollow">CertiK</a>
Aztec Network is a privacy-focused layer-2 <a href="https://cointelegraph.com/news/linea-contributes-zk-rollup-stack-to-linux-foundation-open-source-group" rel="noopener noreferrer nofollow">zero-knowledge</a> (ZK) rollup on Ethereum. Aztec Connect was the previous version of the platform that launched in 2022 as a DeFi <a href="https://cointelegraph.com/news/verus-ethereum-bridge-reportedly-exploited-for-millions" rel="noopener noreferrer nofollow">bridge</a>.
Related: <a href="https://cointelegraph.com/news/crypto-exploit-losses-fall-by-90-in-may-to-68m-certik" rel="noopener noreferrer nofollow">Crypto exploit losses in May fall 90% over month to $68M: CertiK</a>
Aztec Connect was deprecated in March 2023, with deposits halted and the team shifting resources to the next-generation Aztec Network.
“Aztec Labs holds no admin keys or control over the system; it cannot be paused or upgraded by us,” the team said.&nbsp;
Crypto developer “Param” <a href="https://x.com/Param_eth/status/2066198088168227031" rel="noopener noreferrer nofollow">said</a> Aztec Connect’s smart contracts became “fully immutable” and could no longer be upgraded or paused.
“The incident is another reminder that abandoned DeFi contracts can still become targets years later,” they said.&nbsp;
Magazine: <a href="https://cointelegraph-magazine.com/openai-ipo-sec-hungary-crypto-hodlers-digest/" rel="noopener noreferrer nofollow">OpenAI files for IPO, SEC scraps 611 rule and Hungary overhauls crypto: Hodlers Digest</a>

Aztec Connect’s abandoned smart contract exploited for $2.1M

Cointelegraph

Other articles published on Jun 15, 2026

Join our free newsletter for daily crypto updates!