Repeat $2.16 million Aztec exploit raises concerns over legacy DeFi contracts

Traders Union
All News
Crypto
Aztec hit again

Highlights

Aztec’s deprecated Private Rollup Bridge lost about $2.16 million.
The attacker withdrew ETH, DAI and renBTC from old immutable contracts.
Aztec said the current network and AZTEC token were not affected.

Another attack on abandoned infrastructure

The attacker targeted Aztec’s old Private Rollup Bridge, a product launched in 2021 and closed in 2022, Coinpedia reports. Although the bridge had been discontinued, its smart contracts remained active because they were immutable, meaning Aztec could not pause or upgrade them after deployment.

The attacker withdrew 1,158 ETH, 150,000 DAI and 0.47 renBTC, according to SlowMist data. The exploit wallet was reportedly funded with just 0.134 ETH from HitBTC before the attack.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The attack followed another exploit discovered on June 14 involving the deprecated Aztec Connect product, which led to losses estimated at more than $2.15 million. That earlier incident also targeted legacy infrastructure, not the current Aztec network.

Escape hatch weakness

SlowMist researchers linked the latest exploit to a weakness in the bridge’s escape hatch function, an emergency withdrawal mechanism designed to let users recover funds under certain conditions. The problem, according to the report, was that the contract did not properly verify withdrawal requests and trusted some submitted transaction data without independently confirming fund ownership.

That allowed the attacker to submit a proof that appeared valid while using manipulated withdrawal information. The contract then released funds it should not have approved. The case shows how even emergency tools can become attack surfaces if verification logic is incomplete.

Aztec Labs said the affected product has no link to the current network, current smart contracts or the AZTEC ERC-20 token. The company also said it no longer has administrative control over the old bridge, which limits its ability to intervene after the exploit.

Legacy code remains a DeFi liability

The Aztec incidents highlight a recurring risk in decentralized finance: old smart contracts can remain economically relevant long after teams stop maintaining them. If funds are still inside those contracts, immutability can protect users from arbitrary changes but also prevent emergency fixes.

For users, the main issue is not only whether a current protocol is secure, but whether older products still hold assets and whether their shutdown process was complete. For developers, the lesson is clearer: deprecation does not end risk. If contracts cannot be upgraded, projects need stronger withdrawal campaigns, monitoring and public warnings before legacy systems become targets.

We also reported Verus-Ethereum Bridge loses more than $11 million in validation exploit.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.