Another Network faces exploit: $2 million in crypto stolen. June 18, 2026 UToday general At the time, Aztec Network's Private Rollup Bridge was the target of an exploit that allegedly caused losses of about $2.16 million.

Aztec exploited twice in three days as attackers drain over $4M. Aztec is dealing with something that no protocol wants to face, a second exploit within 72 hours. What started as a $2.1 million breach on June 14 has now been followed by a separate $2 million attack three days later, targeting a different deprecated contract through the same fundamental flaw: compromised zero-knowledge proof verification. Together, the two incidents have drained more than $4 million and raised uncomfortable questions about the long-tail risk of immutable legacy infrastructure that protocols can no longer control. The Aztec Foundation confirmed the second incident in a statement, noting it was made aware of the exploit targeting a deprecated product that occurred on June 17, 2026. The foundation was explicit that the affected product has no links to any smart contracts related to the current Aztec network or the AZTEC ERC-20 token, but the timing makes the reassurance a harder sell than it would otherwise be. Contents [hide] The first exploit: Aztec Connect drained on June 14. The sequence begins three days ago. Aztec again acknowledged that an attacker drained approximately $2.1 million from Aztec Connect on June 14, targeting a deprecated contract that had been shut down in 2023. The attack vector was a vulnerability in the rollup proof verification system, a technically sophisticated entry point that required the attacker to understand how Aztec's cryptographic architecture processed and validated proofs. The assets stolen in that first attack included approximately 909 ETH, 270,000 DAI, 167 wstETH, and a mix of other assets. Aztec Labs confirmed after the fact that the contract was immutable and could not be paused, meaning once the attacker identified and executed the exploit, there was no emergency intervention available to stop the drain. The funds moved, and the team could only observe and document. The immutability that was once a feature, signaling trustlessness and resistance to admin manipulation, became a liability the moment a vulnerability surfaced in code no one could touch. Three days later, the Private Rollup Bridge falls. If the first exploit raised eyebrows, the second one, arriving just 72 hours later, has raised the alarm considerably further. Param ETH's analysis details how this time the attacker targeted the Private Rollup Bridge, exploiting a critical function known as the "escape hatch", a mechanism typically designed as a safety release valve for users to exit under specific conditions. The attacker did not find a private key or exploit a reentrancy vulnerability. Instead, they constructed a specially crafted zero-knowledge proof, a fake proof that the contract's verification logic accepted as valid. Once accepted, the contract released the funds as if the transaction were legitimate. Approximately 1,158 ETH worth around $2 million exited through that mechanism before the attack was identified. The technical signature here is significant. A fake ZK proof that passes verification is not a brute-force attack or a social engineering play, it requires deep familiarity with how the proof system is structured and where its validation logic can be deceived. Whether the two exploits share a common attacker or methodology remains under investigation, but the fact that both targeted ZK proof verification within three days of each other is not easy to dismiss as coincidence. Both exploits share the same root vulnerability. Stepping back across both incidents, PeckShield's monitoring and on-chain analysts draw a clear through-line: both exploits originated from flaws in how zero-knowledge proofs were verified, and both targeted bridge infrastructure rather than the core Aztec network itself. The core protocol and the current AZTEC token remain unaffected, the Aztec Foundation has been clear on that point. But that distinction, while technically accurate, does not fully resolve the confidence problem. Deprecated does not mean disconnected in the minds of users who see $4 million leave a protocol's ecosystem in three days. Bridge exploits in particular have a history of triggering withdrawal cascades because they hit the infrastructure that users rely on to move funds in and out and once that trust erodes, it tends to move faster than any remediation plan. What immutable contracts mean for legacy risk. The Aztec incidents surface a tension that the broader DeFi ecosystem has not fully resolved. Immutable smart contracts offer genuine security guarantees, they cannot be altered by developers, rug-pulled by insiders, or quietly modified in ways that harm users. That architecture sits at the philosophical core of trustless finance. But immutability also means that when a vulnerability exists in deprecated code, the team is left watching from the sidelines. Aztec Labs holds no admin keys over the affected systems. It cannot pause them, upgrade them, or redirect funds. The Aztec Foundation's statement makes this explicit and it is not a deflection, it is simply the technical reality of how these contracts were designed. The question the industry now has to sit with is how protocols responsibly manage the long-term risk of legacy infrastructure they no longer control. Sunsetting a product does not drain it of funds immediately, and as long as capital remains locked in deprecated contracts, the attack surface remains live. Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.

Aztec Network bridge exploit drains over $2.16 million in crypto assets. Thu, 18 Jun 2026, 13:01 pm UTC Aztec Network bridge exploit drains over $2.16 million in crypto assets. Source: photo by panumas nikhomkhai. Aztec Network has once again come under scrutiny after its Private Rollup Bridge was reportedly exploited in a security breach that resulted in the loss of more than $2.16 million in cryptocurrency assets. According to blockchain security firm PeckShield, the attacker successfully withdrew approximately 1,158 ETH, 150,000 DAI, and 0.47 renBTC from the bridge infrastructure. Based on current market valuations, the stolen assets are worth over $2 million, making the incident another significant setback for the decentralized finance (DeFi) sector. On-chain data indicates that the exploit was executed through Aztec Network's Private Rollup Bridge. Investigators also noted that the attacker's wallet was initially funded with just 0.134 ETH from cryptocurrency exchange HitBTC, a detail often used by blockchain analysts when tracing the origins of malicious transactions. The incident has sparked concern throughout the crypto community, particularly because reports suggest Aztec Network may have experienced another security issue only a week earlier. The apparent recurrence of vulnerabilities has raised questions about the platform's security architecture and risk management practices. Crypto bridges and rollup solutions remain among the most attractive targets for hackers due to the large amounts of liquidity they hold. As cross-chain infrastructure continues to expand, security challenges remain a major concern for developers, investors, and users alike. Discover more Bitcoin mining equipment Distributed & Cloud Computing Crypto news platform The latest Aztec Network exploit arrives amid a broader wave of attacks targeting smart contracts, DeFi protocols, and blockchain bridges. Repeated security breaches can significantly damage user confidence, especially when they occur within a short period of time. Trust is a critical factor in the adoption of decentralized technologies, and recurring incidents may discourage liquidity providers and users from participating in affected ecosystems. Moving forward, Aztec Network is expected to conduct a comprehensive investigation to determine the root cause of the exploit. The project will likely release a post-mortem report, implement security improvements, and explore potential recovery options for affected funds. Discover more Currencies & Foreign Exchange Financial Markets News Blockchain news subscription The attack serves as another reminder that while blockchain projects continue to push the boundaries of privacy, scalability, and innovation, security remains the foundation of long-term success. As cybercriminals become increasingly sophisticated, DeFi protocols must continually strengthen their defenses to protect user assets and maintain trust in the rapidly evolving cryptocurrency industry.