Test

Connect

when

Aztec

An attacker drained more than $2.1 million from Aztec Connect on Jun. 14, exploiting a verification flaw in a privacy protocol that shut down three years ago.
<h2 id="key-points">Key Points:</h2>
<blockquote>
 <ul>
 <li>An attacker pulled roughly $2.19 million from Aztec Connect on Jun. 14, three years after the protocol was retired.</li>
 <li>The exploit abused a gap in the contract's proof verification, letting withdrawals draw on balances no deposit backed.</li>
 <li>Aztec Labs said it holds no admin keys and cannot pause or upgrade the immutable contracts.</li>
 </ul>
</blockquote>
<h2 id="certik-flags-aztec-connect-drain">CertiK Flags Aztec Connect Drain</h2>
CertiK caught the suspicious activity within hours of the attack. It <a href="https://www.cryptotimes.io/2026/06/15/aztec-exploit-drains-2-19m-from-dormant-privacy-protocol/" rel="noopener noreferrer nofollow">flagged</a> a drain from the RollupProcessorV3 contract on Ethereum, the deprecated bridge's core component. Fellow security firm BlockSec confirmed the same breach soon after and first suspected a missing access control in the code.
The weakness sat in how the contract checked proof data, with one path verifying the full transaction set while the settlement logic <a href="https://cryip.co/aztec-connect-exploit-drains-2-19m-from-deprecated-protocol-aztec-network-safe/" rel="noopener noreferrer nofollow">read</a> that same data differently. The mismatch let the attacker credit value with nothing behind it, producing balances no deposit ever supported.
The attacker ran the trick across seven assets in a single sweep. The haul included 909 Ether<a href="https://yellow.com/asset/eth" rel="noopener noreferrer nofollow">(ETH)</a>, roughly 270,000 Dai<a href="https://yellow.com/asset/dai" rel="noopener noreferrer nofollow">(DAI)</a>, 167 wrapped staked Ether and a handful of yield-bearing tokens. On-chain records traced the funds to a fresh wallet financed earlier through a mixing service, a sign the move was prepared well in advance.
Also Read:<a href="https://yellow.com/news/bitcoin-bulls-eye-67k-trump-hormuz" rel="noopener noreferrer nofollow">Bitcoin Bulls Eye $67K After Trump Says Hormuz Will Open To All</a>
<h2 id="aztec-labs-holds-no-admin-keys">Aztec Labs Holds No Admin Keys</h2>
The Aztec Foundation confirmed the incident not long after the alarm went up, and it <a href="https://x.com/aztecFND/status/2066175938887619055?s=20" rel="noopener noreferrer nofollow">stressed</a> that the breach leaves the AZTEC<a href="https://yellow.com/asset/aztec" rel="noopener noreferrer nofollow">(AZTEC)</a> token and the live Aztec network untouched. The token barely flinched, trading near a cent through the day, while the retired bridge, first launched in 2022, has stood dormant since Mar. 2023.
Aztec Labs said it could not step in. The deprecated contracts hold no admin keys, so no one can pause or upgrade them, and developer Param<a href="https://www.gncrypto.news/news/attacker-drains-2-1m-deprecated-aztec-connect-exploit/" rel="noopener noreferrer nofollow">explained</a> the code turned fully immutable once the bridge wound down. Investigators are still tracing the stolen funds across the network.
<h2 id="abandoned-defi-contracts-stay-risky">Abandoned DeFi Contracts Stay Risky</h2>
The episode underlines a problem the industry keeps relearning, since dead protocols still hold real money long after their teams move on. Immutable code cannot be patched once a weakness surfaces, which leaves these abandoned systems, now widely called zombie contracts, open to attack for years.
The drain caps a rough stretch for on-chain security. Exploits this month have cost roughly $44 million across at least a dozen incidents with several smaller protocols hit in recent weeks. That tally follows a brutal April, when two attacks alone drove monthly losses past $625 million and set a record for incident count.
Read Next:<a href="https://yellow.com/news/index-rules-spacex-2t-debut-market-stress-test" rel="noopener noreferrer nofollow">Index Rules Turn SpaceX's $2T Debut Into A Market Stress Test</a>

Aztec Connect Loses $2.1M In Exploit Of Zombie Contract Frozen For 3 Years

Table of Contents

Yellow News

Other articles published on Jun 15, 2026

Join our free newsletter for daily crypto updates!