JPMorgan

Connect

Worldcoin

ERC20

Aztec

<p>Aztec Labs said it is investigating a potential exploit affecting a deprecated Aztec payments product from 2021.</p>
<div id="cn-block-summary-block_7e38ed1d59fd254befeaaa7bd019cd09" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>Aztec Labs says about $2m moved from a deprecated 2021 payments product contract on Ethereum.</li>
   <li>The Aztec Foundation says current contracts and AZTEC ERC20 token are unrelated to this incident.</li>
   <li>The new probe follows a separate Aztec Connect exploit reported only days earlier this week.</li>
  </ul>
 </div>
</div>
<p>In an <a href="https://x.com/AztecLabs_/status/2067511785637163354?s=20" rel="noopener noreferrer nofollow">Aztec Labs post</a>, the team said about $2 million was transferred from an immutable smart contract in an <a href="https://etherscan.io/tx/0xab306cd2184d23b6ba3e151b10b3b9a0b81f211cc16f4f3b0c79f0b17a59c2b5" rel="noopener noreferrer nofollow">Etherscan transaction</a> on June 17.</p>
<p>The company said the affected product was an “immutable stage 2 rollup” that was sunset in 2022. It also said Aztec Labs holds no admin keys or control over the system, meaning it cannot pause or upgrade the old contract.</p>
<p>You might also like: <a href="https://crypto.news/jpmorgan-restricts-anthropic-claude-access-for-employees-in-hong-kong/" rel="noopener noreferrer nofollow"> JPMorgan restricts Anthropic Claude access for employees in Hong Kong </a></p>
<h2 class="wp-block-heading" id="strong-foundation-says-current-network-is-separate-strong"><strong>Foundation says current network is separate</strong></h2>
<p>The Aztec Foundation said it was made aware of the possible exploit on June 17. In a <a href="https://x.com/aztecFND/status/2067511967237939636?s=20" rel="noopener noreferrer nofollow">Foundation post</a>, it said there are “no links” between the deprecated product and any smart contracts tied to the current network or the AZTEC ERC20 token.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>The Aztec Foundation was made aware of a potential exploit targeting a deprecated product which occurred on June 17, 2026. There are no links between this product and any smart contracts related to the current network or the AZTEC ERC20 token.<br><br>The product was deprecated 4 years… <a href="https://t.co/kANaIuw8HF" rel="noopener noreferrer nofollow">https://t.co/kANaIuw8HF</a></p>— Aztec Foundation (@aztecFND) <a href="https://x.com/aztecFND/status/2067511967237939636?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 18, 2026</a>
  </blockquote>
 </div>
</figure>
<p>The foundation also said the product was deprecated four years ago and that Aztec Labs no longer controls the system. It directed users to Aztec Labs for updates as the team reviews the transaction and the affected contract.</p>
<h2 class="wp-block-heading" id="strong-second-old-product-incident-in-days-strong"><strong>Second old-product incident in days</strong></h2>
<p>Aztec Labs said the latest case is separate from the June 14 exploit involving Aztec Connect, another deprecated product. As previously reported by crypto.news, <a href="https://crypto.news/aztec-connect-loses-2-1m-after-old-contract-exploit/" rel="noopener noreferrer nofollow">Aztec Connect lost $2.1 million</a> after an old immutable smart contract was exploited.</p>
<p>According to an earlier crypto.news report, <a href="https://crypto.news/aztec-connect-loses-2-1m-after-old-contract-exploit/" rel="noopener noreferrer nofollow">the Aztec Connect attack</a> involved a verification mismatch that let unbacked balances move through Ethereum settlement records. Security firms later traced the issue to an old RollupProcessorV3 contract.</p>
<h2 class="wp-block-heading" id="strong-old-immutable-contracts-remain-a-risk-strong"><strong>Old immutable contracts remain a risk</strong></h2>
<p>The new case again points to a problem facing discontinued DeFi products. Even after a product shuts down, its contracts can remain live on Ethereum. If funds stay inside immutable contracts, attackers may still look for paths to move them.</p>
<p>That creates a hard response problem. A live team may be able to warn users and track funds, but it may not be able to stop an old contract that has no admin controls. Aztec Labs said it will share further updates “in due course.”</p>
<p>For now, Aztec Labs and the Aztec Foundation are drawing a clear line between the old payments product and the current network. The main claim from both groups is that the incident concerns a deprecated system, not the active Aztec network or the AZTEC token.</p>
<p>Read more: <a href="https://crypto.news/worldcoin-altman-identity-bet/" rel="noopener noreferrer nofollow"> Worldcoin jumped 120%. Inside the Sam Altman identity bet </a></p>

Aztec probes $2m transfer from old payments product

Table of Contents

crypto.news

Other articles published on Jun 18, 2026

Join our free newsletter for daily crypto updates!