Aztec Hit Again: Another $2.16 Million Drained Just Days After Previous Exploit

On June 17, Aztec Labs was found itself in the middle of an exploit for the second time in a week. An attacker drained around $2.16 million from Aztec’s deprecated Private Rollup Bridge. In response, Aztec Labs said the affected product has no connection to the current Aztec network or the AZTEC token.

Aztec Lost $2.16 Million as Attacker Drained

According to blockchain security firm SlowMist, the attacker targeted Aztec’s old Private Rollup Bridge, a product launched in 2021 and closed in 2022. Although the system was shut down, its smart contracts remained active on-chain because they were immutable.

SlowMist says the attacker managed to withdraw 1,158 ETH, 150,000 DAI, and 0.47 renBTC. 

Interestingly, the exploit wallet (x73790…42a2ba) was initially funded with just 0.134 ETH from crypto exchange HitBTC before carrying out the attack.

Following news of the exploit, AZTEC declined about 1.6%, with the token trading near $0.0160 as investors reacted to the news.

How was the Aztec Lab Exploited?

Researchers at SlowMist said the exploit was linked to a weakness in the bridge’s escape hatch () function, which was originally designed as an emergency withdrawal tool.

Their investigation found that the function lacked important security checks. The contract failed to properly verify withdrawal requests and trusted certain transaction data without independently confirming ownership of the funds.

As a result, the attacker (0x695…78e97f)was able to submit a seemingly valid proof with manipulated withdrawal information, causing the contract to release funds it should not have approved.

Aztec Says Current Network Is Safe

Following the exploit, Aztec Labs said the affected product has no connection to the current Aztec network or the AZTEC token. The company explained that the bridge was shut down four years ago and operates as an immutable Stage 2 rollup.

Because the contract is immutable, Aztec Labs cannot pause, upgrade, or directly intervene in the system. The team added that it no longer holds administrative control over the affected infrastructure.

The recent attack comes only days after another exploit involving the deprecated Aztec Connect product. That attack was discovered on June 14 and resulted in estimated losses of more than $2.15 million.