Aztec hit by second $2.1M exploit in less than a week from deprecated contract

Aztec's deprecated private rollup bridge was exploited for $2.15 million, the second hack in a week, as abandoned smart contracts remain vulnerable.

• The attacker used a false rollup proof to drain 1,158 ETH, 150,000 DAI and 0.46 renBTC from an immutable contract.
• Aztec Labs confirmed the contract was deprecated in 2022 and they held no admin keys to pause it.
• This follows a separate $2.1M exploit of Aztec Connect's deprecated contract on Sunday.
• SlowMist warned that deprecated smart contracts can remain vulnerable long after projects stop maintaining them.
• Security experts advise protocols to migrate legacy assets out of abandoned contracts to eliminate exposure.

Coinporta summarises news for fast scanning. Full reporting belongs to the source.

Last updated 19 Jun 2026