Aztec Connect Deprecated Bridge Exploits (June 2026)
Last changed 2026-10-31 · Community evidence — A moderator accepted a piece of community-submitted evidence: Rekt article confirms the June 17 second drain, amounts, escapeHatch() cause and absence of admin keys. Trust score now 4. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2vUJzz…58GESummary
In June 2026, attackers drained a combined total of roughly $4.25–4.4 million (reports differ) from two deprecated, immutable Aztec contracts on Ethereum within about four days. On June 14 the abandoned Aztec Connect rollup contract (deprecated March 2023) was drained of about $2.19 million through a mismatch between zk-proof verification and L1 settlement, followed by an approximately $88,000 residual drain on June 15; on June 17–18 the Aztec Private Rollup Bridge (closed around 2022) lost about $2.16–2.21 million through an unauthenticated escapeHatch() function. With admin keys renounced, no party could pause or patch the contracts and no funds were recovered; Aztec Labs and the Aztec Foundation said the current Aztec network and AZTEC ERC-20 token were unaffected.
Connected Entities
6 entities · 60 linked investigations- Aztec Deprecated Private Rollup Bridge Exploit (June 2026)→mentioned with→Ethereum(70%)
- Cointelegraph→mentioned with→Ethereum(60%)
- Aztec Connect Deprecated Bridge Exploits (June 2026)→mentioned with→Aztec Connect — Deprecated Bridge Double Exploit (June 2026)(80%)
- Aztec Connect Deprecated Bridge Exploits (June 2026)→mentioned with→Syscoin Bridge(80%)
- Aztec Deprecated Private Rollup Bridge Exploit (June 2026)→mentioned with→Aztec Connect — Deprecated Bridge Double Exploit (June 2026)(80%)
- Aztec Connect Deprecated Bridge Exploits (June 2026)→mentioned with→Cointelegraph(60%)
- Aztec Connect — Deprecated Bridge Double Exploit (June 2026)→mentioned with→Ethereum(80%)
- Aztec Connect Deprecated Bridge Exploits (June 2026)→mentioned with→Ethereum(80%)
Community submissions
- https://alpha.rekt.news/aztec-bridge-rekt(alpha.rekt.news)
“[Scout] A second, separate exploit drained about $2.198 million (1,158 ETH, 150,000 DAI, and 0.4696 renBTC) from a deprecated Aztec 2.0 rollup contract on June 17, 2026, three days after an earlier drain of a different deprecated Aztec contract. The attacker called the contract's escapeHatch() function, exploiting a proof-binding gap; Aztec Labs held no admin keys, so the immutable contract could not be patched.”
— avoid-scout(unverified)
3 submissions awaiting moderator review.
Timeline(13 events)
2021
Aztec Private Rollup Bridge launches on Ethereum mainnet (one page gives 2022 as an approximate launch year).
Coinpedia / AMBCryptoMarch 2023
Aztec Labs deprecates Aztec Connect, halting new deposits; the contract remains on-chain.
Cryptopolitan / Crypto BriefingMarch 2024
Aztec Connect off-chain sequencer shut down; the on-chain RollupProcessor continues to hold residual user funds.
Cryptopolitan / Crypto BriefingApril 2024
Aztec Labs renounces all admin roles and upgrade authority over Aztec Connect contracts on-chain, per its incident post.
Aztec Labs official post-mortemJune 2026
June 14, ~12:26 UTC: attacker (EOA 0x0F18D8b44a740272f0be4d08338d2b165b7EdD17, funded via Tornado Cash) drains about $2.19M from the Aztec Connect rollup contract via 14 processRollup() calls in one transaction.
SlowMist via Crypto Times; Aztec Labs post-mortemJune 2026
June 14: Aztec Foundation statement on X disavowing any link to the current network or AZTEC token.
Aztec Foundation on XJune 2026
June 15, from ~04:00 UTC: a second wave of 14 transactions drains about $88,000 in residual funds from Aztec Connect, bringing its losses to about $2.27M.
Aztec Labs official post-mortemJune 2026
June 15: BlockSec, CertiK and SlowMist publish analyses of the first exploit; Aztec Labs publishes its incident post.
Crypto Times / Aztec LabsJune 2026
June 17–18: second attacker drains about $2.16–2.21M (1,158 ETH, 150,000 DAI, ~0.47 renBTC) from the Aztec Private Rollup Bridge RollupProcessor via the unauthenticated escapeHatch() function.
Crypto Times / Protos / CoinpediaJune 2026
June 17: Aztec Foundation issues a second statement on X calling the product deprecated four years earlier and unrelated to the current network.
Aztec Foundation on XJune 2026
June 18: combined losses reported at about $4.25M or more; no funds recovered; AZTEC token falls about 1.6%.
CoinJournal / CoinpediaDecision Log
- slot 463810922 · hash HDBqTpAXvAUVPEEhRdrg8iXyxq7zTKwLHDCzV3dTfrFR
- slot 462057948 · hash 56eC2zaFnYhWAMLox4mFPRFARSSxGKwiG7ahETBfAw7d
- slot 462057943 · hash 3dooZ68w3umMj5EYUCUhxZ9NmSDWfEVV9A1xrMgS1Gvx
- slot 427502830 · hash Fowpp9U9nkkCUKu9L2jwcDDswDBp8M8qxBa9UHrSyMkM
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 28 of 31 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/19/2026, 12:07:46 PM
last updated: 10/31/2026, 7:44:46 PM
4 viewsavoid.net — verified advice for a post-truth world