Aztec Labs says a deprecated DeFi platform, Aztec Connect, was drained of roughly $2.1 million in crypto after an attacker exploited a flaw tied to the way the protocol verified and settled transactions on Ethereum. The issue appears to have targeted the bridge-era contract logic rather than the live Aztec Network.
According to Aztec Labs’ update on X, the transfers were conducted from Aztec Connect’s smart contract, and the company said the incident did not impact users or assets on the current Aztec network. Still, the event adds to a broader pattern of this month’s exploit activity across decentralized finance.
Key takeaways
- Aztec Connect—deprecated since March 2023—lost about $2.1 million after an attacker abused its transaction verification and Ethereum settlement logic.
- BlockSec said the exploit stemmed from a mismatch between “verified” transaction inputs and the set enforced by the ZK proof, enabling unbacked balances.
- The attacker reportedly withdrew funds multiple times across seven different assets, including 909 ETH and 270,000 DAI.
- Aztec Labs stated it holds no admin keys and cannot pause or upgrade the system, and developers described Aztec Connect contracts as effectively immutable.
- The incident follows other large June compromises, including a reported $30 million loss tied to Humanity Protocol and $8 million from a Syscoin bridge exploit.
What happened to Aztec Connect
Aztec Labs posted on X that it was investigating a potential exploit affecting Aztec Connect. The company said approximately $2.1 million was moved from the platform’s smart contract, while the active Aztec network—its current privacy-focused layer-2 ZK rollup on Ethereum—was not affected.
Crypto security firm BlockSec later described the mechanics behind the exploit. In its analysis, BlockSec said an attacker took advantage of how Aztec Connect verified transactions and how those transactions were settled on Ethereum. The core problem, according to BlockSec, was a mismatch in binding: verified transactions on the Aztec Connect contract were “not effectively bound” to the transaction set enforced by the ZK proof.
A verification-versus-settlement mismatch enabled unbacked withdrawals
BlockSec explained that this gap allowed the verification path and settlement logic on Ethereum to “interpret the transaction list differently.” In practical terms, that created a path where the contract could credit value for transactions that were not validated on Ethereum in the way the settlement logic expected.
Once the attacker introduced transactions that resulted in unbacked balances, those balances could be withdrawn. BlockSec said the exploitation occurred seven times across seven different assets, suggesting the attacker used repeatable steps to drain multiple token balances rather than relying on a single one-off failure.
The assets reported as stolen include 909 Ether (ETH), 270,000 Dai (DAI), 167 wrapped staked Ether (wstETH), and several other cryptocurrencies. A related breakdown posted by CertiK on X referenced the scope of the stolen assets.
Why a deprecated bridge contract still matters
Aztec Connect was the earlier bridge version of Aztec’s system, launched in 2022. Aztec Network is now described as a privacy-focused layer-2 ZK rollup on Ethereum, with Aztec Connect representing the prior generation of tooling.
Aztec Connect was deprecated in March 2023, with deposits halted as the team directed efforts toward the next-generation Aztec Network. However, Aztec Labs maintained that it did not have control over the compromised component: the company stated it “holds no admin keys or control over the system,” adding that it cannot pause or upgrade it.
Independent developer “Param” also said the Aztec Connect smart contracts became “fully immutable,” reinforcing the idea that once the bridge logic was retired, it could not be patched or stopped in response to later threats.
That distinction is important for investors and builders: even when a protocol is deprecated and deposits are halted, the remaining on-chain code and balances can still attract attackers—particularly if the contract cannot be upgraded or paused. In this case, an exploit surfaced more than a year after deprecation, illustrating how long-lived smart contract artifacts can remain security liabilities.
Broader exploit pressure in June
This Aztec Connect incident lands amid heightened exploit losses across DeFi. DeFiLlama data referenced in coverage points to at least $44 million stolen so far in June from 12 other exploits.
Earlier in the month, the largest loss highlighted was a reported $30 million suffered after a private key compromise on the Humanity Protocol on June 8. The day before, a Syscoin Bridge exploit reportedly resulted in $8 million stolen through a fake proof mechanism.
While each incident stems from different technical failures, the pattern is consistent: attackers continue to find weaknesses across both active and legacy contracts, and even well-known ecosystems can remain exposed through older infrastructure.
What to watch next
For users and DeFi operators, the main question is whether Aztec Labs will be able to offer any practical mitigation beyond investigation—especially given its claim that it cannot pause or upgrade the affected system. More broadly, readers should watch for additional forensic disclosures on the exact transaction-binding failure described by BlockSec, and whether the exploit pattern points to similar design risks in other retired bridge-era contracts.
