Back
Deprecated Aztec payments product reportedly drained of about $2.15 million

Deprecated Aztec payments product reportedly drained of about $2.15 million

Aztec Labs said it is investigating a second exploit in four days affecting retired Aztec infrastructure, while BlockSec linked the latest drain to a separate validation flaw in an old immutable rollup.

ETH
DAI

Fact Check
The official Aztec Labs statement directly confirms ~$2.1M was moved from the immutable Aztec Connect smart contract deprecated three years ago. The Defiant's detailed report and KuCoin corroborate 908.99/909 ETH drained on June 14 via a ZK proof-verification flaw in RollupProcessorV3, and confirm Aztec Foundation's statement that the exploit has no connection to the AZTEC token or current Aztec network. These match the claim's core facts: ~909 ETH, ~$2M, immutable deprecated payments contract, unrelated to current network/token. Two caveats reduce certainty slightly: (1) the claim's framing that the incident is 'separate from the June 14 Aztec Connect exploit' is inaccurate — the deprecated-contract drain IS the June 14 Aztec Connect exploit, though sources note a distinct later exploit days afterward; (2) the contract was deprecated/shut down in 2023 with keys burned in 2024 rather than 2021 as the content suggests. The central material claims are well-supported by an official primary source and multiple independent reports.
Summary

Aztec Labs is investigating an exploit of a deprecated Aztec payments product that drained about $2.15 million in crypto assets, marking the second attack on retired Aztec infrastructure in four days. PeckShield estimated the latest exploit took 1,158 ETH, 150,000 DAI and about 0.47 renBTC, while BlockSec said the incident appears related to the June 14 Aztec exploit but struck a different pool through a separate entry point. BlockSec attributed the drain to a validation flaw that let an attacker withdraw funds while still passing onchain verification checks, adding that it was not the same bug as the earlier incident even though both involved circuit public input binding issues and a similar execution trace. Aztec Labs said it would provide further updates, and the Aztec Foundation said the affected product was an immutable stage 2 rollup deprecated four years ago with no link to the current network or the AZTEC ERC20 token.

Terms & Concepts
  • stage 2 rollup: A rollup design intended to operate without centralized control, which can make fixes difficult once the code is immutable.
  • onchain verification checks: Automated checks performed by smart contracts on a blockchain to confirm whether a transaction or withdrawal meets protocol rules.
  • renBTC: A tokenized form of Bitcoin used on other blockchain networks.