Aztec Connect, a deprecated DeFi bridge linked to the privacy-focused Aztec ecosystem, was exploited on June 14, 2026, after an attacker drained about $2.19 million from an old Ethereum smart contract. According to crypto.news, the attack used a verification mismatch, allowing unbacked balances to move through settlement on Ethereum records. BlockSec's Phalcon team confirmed the losses exceeded $2.15 million after suspicious activity hit the contract, with the same pattern repeated seven times across several assets. The exploit was detected by CertiK around 13:52 UTC and officially confirmed by Aztec Labs at 15:06 UTC.
Aztec Labs said it was investigating a potential exploit affecting Aztec Connect while emphasizing that current Aztec Network users and assets were not affected. As reported by crypto.news, the team stated that about $2.1 million had moved from the platform's immutable contract, but stressed that current Aztec Network users and assets were not affected. The exploit targeted Aztec Connect's RollupProcessorV3 contract on Ethereum, exploiting a gap between transaction verification and settlement logic that allowed creation of unbacked balances. The drained assets were residual assets stuck in the old, deprecated Connect contract, not active user deposits on today's system.
According to CertiK data shared on X, the stolen assets included 909 ETH, around 270,513 DAI, 168 wstETH, and smaller amounts of other tokens including yvDAI, yvWETH, LUSD, and yvLUSD. As reported by crypto.news, the attacker funded the wallet through Tornado Cash before the exploit, adding another layer of complexity to the security breach. The attacker wallet 0x0f18d8b44a740272f0be4d08338d2b165b7edd17 received approximately 0.098 ETH originating from Tornado Cash at block 25314825, shortly before the exploit execution. The transaction processed multiple unauthorized rollups with IDs 13277 to 13290 to move the residual assets out. CertiK attributed the exploit to a suspected proof verification flaw, explaining that the computeRootHashes() function only checked the beginning of submitted proof data, while token transfer instructions embedded elsewhere in the data may not have been properly checked. The middle portion of the same _proofData payload contained the data that processDepositsAndWithdrawals() subsequently used to carry out token transfers, allowing an attacker to create malicious proofs where unverified middle sections contained manipulated deposit or withdrawal instructions.
The Aztec Connect exploit adds to another active month for DeFi security incidents, with $81.73 million worth of crypto stolen in 30 days according to DeFiLlama's hacks tracker. According to AMBCrypto, the Total Value Hacked (USD) has now reached $81.73 million in 30 days, with $634.85 million lost in 2026 alone. April saw the highest value drained so far. Several recent incidents include Raydium's old AMM V3 coding error that caused $1.34 million worth of cryptocurrencies to be stolen from five pools, a governance takeover attack that stole about $1.5 million in Ethereum from a Balancer liquidity pool, and a new exploit on Ethereum's Alephium TokenBridge that drained $815,000 in seven minutes using forged VAAs. As previously reported by crypto.news, Humanity Protocol said more than $36 million was stolen after attackers compromised administrative keys linked to its bridge infrastructure across Ethereum and BNB Smart Chain.
The case demonstrates why old DeFi contracts remain part of the security landscape even after products are discontinued. Aztec Connect had once allowed users to access DeFi through a privacy-focused ZK rollup, but deposits were halted when the system was phased out in March 2023. In 2024, Aztec Labs gave up control of the system and removed admin access, making the contracts fully immutable and unable to be upgraded or paused. Unlike a live protocol, the old Aztec Connect system had no operator able to pause activity, leaving response dependent on public warnings and checks by remaining affected users online. The technical cause appears to be a flawed proof check, where the computeRootHashes() function only checked the start of submitted proof data, not the whole payload, allowing an attacker to craft input that passed verification but still triggered transfers. Since the code is frozen, the flaw cannot be patched in place, making recovery unlikely without the attacker's cooperation. Crypto developer "Param" noted that Aztec Connect's smart contracts became "fully immutable" and could no longer be upgraded or paused, emphasizing that "the incident is another reminder that abandoned DeFi contracts can still become targets years later."
