On June 17, Aztec Labs was found itself in the middle of an exploit for the second time in a week. An attacker drained around $2.16 million from Aztec’s deprecated Private Rollup Bridge. In response, Aztec Labs said the affected product has no connection to the current Aztec network or the AZTEC token.
Aztec Lost $2.16 Million as Attacker Drained
According to blockchain security firm SlowMist, the attacker targeted Aztec’s old Private Rollup Bridge, a product launched in 2021 and closed in 2022. Although the system was shut down, its smart contracts remained active on-chain because they were immutable.
SlowMist says the attacker managed to withdraw 1,158 ETH, 150,000 DAI, and 0.47 renBTC.
Interestingly, the exploit wallet (x73790…42a2ba) was initially funded with just 0.134 ETH from crypto exchange HitBTC before carrying out the attack.
Following news of the exploit, AZTEC declined about 1.6%, with the token trading near $0.0160 as investors reacted to the news.
How was the Aztec Lab Exploited?
Researchers at SlowMist said the exploit was linked to a weakness in the bridge’s escape hatch () function, which was originally designed as an emergency withdrawal tool.
Their investigation found that the function lacked important security checks. The contract failed to properly verify withdrawal requests and trusted certain transaction data without independently confirming ownership of the funds.
As a result, the attacker (0x695…78e97f)was able to submit a seemingly valid proof with manipulated withdrawal information, causing the contract to release funds it should not have approved.
Aztec Says Current Network Is Safe
Following the exploit, Aztec Labs said the affected product has no connection to the current Aztec network or the AZTEC token. The company explained that the bridge was shut down four years ago and operates as an immutable Stage 2 rollup.
Because the contract is immutable, Aztec Labs cannot pause, upgrade, or directly intervene in the system. The team added that it no longer holds administrative control over the affected infrastructure.
The recent attack comes only days after another exploit involving the deprecated Aztec Connect product. That attack was discovered on June 14 and resulted in estimated losses of more than $2.15 million.
Was this writing helpful?
Story Ends Here
Trust with CoinPedia:
CoinPedia has been delivering accurate and timely cryptocurrency and blockchain updates since 2017. All content is created by our expert panel of analysts and journalists, following strict Editorial Guidelines based on E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness). Every article is fact-checked against reputable sources to ensure accuracy, transparency, and reliability. Our review policy guarantees unbiased evaluations when recommending exchanges, platforms, or tools. We strive to provide timely updates about everything crypto & blockchain, right from startups to industry majors.
Investment Disclaimer:
All opinions and insights shared represent the author’s own views on current market conditions. Please do your own research before making investment decisions. Neither the writer nor the publication assumes responsibility for your financial choices.
Sponsored and Advertisements:
Sponsored content and affiliate links may appear on our site. Advertisements are marked clearly, and our editorial content remains entirely independent from our ad partners.
Read the Next News
