On June 18, a hacker took advantage of an obsolete smart contract on the Aztec network, leading to losses estimated at $2.15 million. This attack targeted a payments product that had been phased out in 2022.
Aztec Labs confirmed the exploit, stating: "We are investigating a potential exploit affecting a deprecated Aztec payments product from 2021. ~$2m was transferred from the immutable smart contract in transaction: https://t.co/FS4JoNnfiJ"
— Aztec Labs (@AztecLabs_) June 18, 2026
The vulnerability was identified in the proof verification logic of the PrivateRollupBridge contract, with the hacker spending only 0.134 ETH (around $230) to carry out the attack. The hacker successfully withdrew about 1158 ETH, along with 150,000 DAI and 0.47 renBTC.
This incident follows another breach on June 14, where an outdated router contract was exploited for nearly $2.19 million. Aztec Labs emphasized they lack administrative access to control the system, meaning they cannot freeze contracts or implement updates to mitigate future risks.
