Aztec Deprecated Private Rollup Bridge Exploit (June 2026)

avoid.net/aztec-deprecated-private-rollup-bridge-exploit-june-2026→20/100·82% conf.

[AI-DRAFTED · AWAITING VERIFICATION]

20/100

[CRITICAL]82% conf.

Summary

In June 2026, two separate exploits drained a combined total of over $4 million from deprecated Aztec Network smart contracts — Aztec Connect on June 14 ($2.19M) and the Aztec Private Rollup Bridge on June 17 ($2.16M). Both contracts had been shut down years earlier but remained immutable and on-chain, custodying residual user assets with no administrative override capability.

Connected Entities

1 entities · 10 linked investigations

Organizations

□Aztec Deprecated Private Rollup Bridge Exploit (June 2026)

Relationships

Also appears in

edgeX Exchange·28 Saga EVM Blockchain·32 Mach-O Man Malware Campaign (Lazarus / Chollima)·0 Q2 2026 DeFi Record Hack Wave·0 Alephium Bridge·18 Bunni Protocol·28 Shunda Park Scam Compound·0 Thorchain DEX·28 Access Protocol·47 KuCoin Exchange Hack·32

Have evidence about Aztec Deprecated Private Rollup Bridge Exploit (June 2026)?

Timeline(8 events)

2022-01-01

Aztec Private Rollup Bridge launched (approximate year; deprecated approximately 2022)

Aztec Foundation statement via X

2023-03-01

Aztec Connect deprecated; team renounces admin keys, contract remains immutable and on-chain

Aztec Labs statement via Cryptopolitan

2026-06-14

First exploit: attacker (funded via Tornado Cash, address 0x0f18...edd17) drains approximately $2.19M from Aztec Connect RollupProcessorV3 via ZK-SNARK settlement boundary bypass across 14 consecutive processRollup() calls in a single atomic transaction

SlowMist analysis via CryptoTimes

2026-06-14

Aztec Foundation issues official statement distancing current network and AZTEC ERC-20 token from the Aztec Connect exploit

Aztec Foundation — X (Twitter)

2026-06-15

SlowMist publishes detailed root cause analysis of the $2.19M Aztec Connect exploit, identifying ZK-proof settlement boundary mismatch as the core vulnerability

CryptoTimes

2026-06-17

Second exploit: attacker drains approximately $2.16M (1,158 ETH, 150,000 DAI, ~0.47 renBTC) from the deprecated Aztec Private Rollup Bridge via unprotected escapeHatch() function lacking access controls

Aztec Network's RollupProcessor Exploited for $2.21 Million — CryptoTimes

2026-06-17

Aztec Foundation issues second official statement confirming deprecated product status and absence of links to current network or AZTEC ERC-20 token

Aztec Foundation — X (Twitter)

2026-06-18

Combined losses from both exploits reported at over $4 million; no funds recovered; current Aztec network confirmed unaffected

CoinJournal

Provenance & Audit Trail

Anchored on Solana Verify on-chain