Aztec Connect exploit highlights risks of legacy DeFi contracts

Traders Union
All News
Crypto News
Aztec Connect loses $2.1M

Highlights

Aztec Connect lost about $2.1 million from an old immutable Ethereum contract.
Aztec Labs said current Aztec Network users and assets were not affected.
The platform was deprecated in March 2023 after deposits were halted.

Aztec Labs said it was investigating a potential exploit affecting Aztec Connect after about $2.1 million moved from the platform’s immutable contract. The company said Aztec Connect had been deprecated in March 2023 and that Aztec Labs no longer held admin keys or control over the system.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Funds remained after shutdown

Aztec Connect once allowed users to access DeFi through a privacy-focused zero-knowledge rollup on Ethereum. When the product was phased out, deposits were halted, and users were given time to withdraw funds from the old system.

Some assets, however, remained inside the contract. Because the contracts had become fully immutable, they could no longer be upgraded or paused. Unlike an active protocol, the old system had no operator able to stop activity once suspicious transactions began, leaving the response dependent on public warnings, on-chain tracing, and remaining users checking whether they were exposed.

Security firms trace the attack

BlockSec’s Phalcon team said the attack targeted Aztec Connect’s RollupProcessorV3 contract on Ethereum and put the losses above $2.15 million. The core issue, according to BlockSec’s analysis cited by Crypto.News, was a mismatch between how transactions were verified and how they were settled on Ethereum.

That mismatch allowed the attacker to create balances that were not backed by valid value on Ethereum and then withdraw those balances. The pattern was repeated seven times across several assets. Listed the stolen assets as including 909 ETH, about 270,000 DAI, 167 wrapped staked ETH, and smaller amounts of other tokens. The attacker’s wallet was reportedly funded through Tornado Cash before the exploit.

DeFi security problem keeps widening

The Aztec Connect exploit adds to a difficult month for DeFi security. DeFiLlama’s hacks tracker showed several June losses, including $30 million from Humanity Protocol on June 8 and $8 million from Syscoin Bridge on June 7.

The broader picture is mixed. Hack losses fell to $68.3 million in May, down nearly 90% from April, but CertiK said code flaws still caused about $45 million of May’s losses, making them the largest attack path for that month.

Why legacy code still matters

The Aztec case shows that a protocol shutdown is not the same as risk removal. If users leave assets in immutable contracts, and if the code remains live on Ethereum, attackers can keep looking for paths that were missed while the product was active.

For DeFi teams, the lesson is operational as much as technical. Deprecation plans need clear withdrawal processes, long monitoring periods, and public communication that treats old contracts as active risk surfaces. For users, the message is simpler: funds left in abandoned systems can remain exposed years after a product disappears from normal use.

We have previously highlighted that the Humanity Protocol token plunges 85% after a $30M hack.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.