Rollup bridge exploit drains $2M in crypto

TLDR

A deprecated Aztec Network bridge contract on Ethereum has been exploited for about $2.1 million in crypto assets.

1. Aztec Network's Private Rollup Bridge was drained of roughly 1,158 ETH, 150,000 DAI and renBTC, with on chain firms estimating losses around $2.15 million.
2. Aztec Labs says only old immutable infrastructure was hit and that the current Aztec network and AZTEC token are unaffected, but this is its second exploit within a few days.
3. The hack highlights structural risks in rollup and bridge contracts, especially deprecated ones that still hold funds, and underscores the need to watch bridge security and deprecation plans.

Deep Dive

1. Exploit Details And Method

Blockchain security firms including PeckShield reported that Aztec Network's Private Rollup Bridge contract was exploited for about $2.15 million in assets, including 1,158 ETH, 150,000 DAI and 0.46 to 0.47 renBTC, from a wallet initially funded with only 0.134 ETH from HitBTC. One alert flagged the loss as approximately $2.165 million.

Analysis from security researchers such as SlowMist and others indicates the attacker abused the bridge's emergency "escape hatch" and rollup proof verification. By submitting a specially crafted zero knowledge proof, they triggered the contract's withdrawal logic without a correctly matching underlying state, allowing them to pull the bridge's liquidity in a single sequence. Coverage of the incident describes this as a proof validation flaw rather than a stolen key or simple reentrancy bug, and places the loss around $2.1 to $2.2 million in value at the time of the attack.

2. Scope, Impact And Prior Hack

The affected bridge is part of Aztec's legacy infrastructure, launched around 2021 and deprecated in 2022, but its smart contracts remained live and immutable on Ethereum. Aztec Labs and the Aztec Foundation state that this deprecated product has "no links" to the current Aztec network or the AZTEC ERC20 token, and that they hold no admin keys to pause or upgrade it, as described in updates on the deprecated product and follow up reports on the two incidents in three days.

This exploit follows another roughly $2.1 million loss days earlier from Aztec Connect, another deprecated rollup contract that still held residual user funds, bringing combined losses above $4 million from legacy Aztec contracts. Post hack coverage notes that AZTEC itself saw only a modest price reaction of around a low single digit percentage decline around the news, and that current network contracts have not been reported as compromised.

3. Bridge Risk And User Takeaways

Both the Private Rollup Bridge and the earlier Aztec Connect exploit were tied to flaws in zero knowledge proof verification in immutable, deprecated contracts that still held funds, as summarized in technical post mortems such as this multi exploit overview. This pattern reinforces that rollup and cross chain bridges concentrate large locked balances and remain high value targets.

For users, the main lessons are to minimize how long funds sit in bridges, to prefer actively maintained infrastructure with clear audit and upgrade paths, and to be cautious where a protocol labels a product "deprecated" but on chain contracts still hold assets. Monitoring project communications about legacy contract migration, as seen in Aztec's statements around the deprecated payment product, is a useful risk check before leaving funds in older systems.

Conclusion

A legacy Aztec rollup bridge being drained for about $2.1 million shows how vulnerabilities in zero knowledge proof verification and immutable, unmaintained contracts can turn old infrastructure into attack surfaces. While current Aztec network contracts and the AZTEC token are reported as unaffected, repeated exploits on deprecated bridges reinforce that users should treat bridge exposure as a time limited risk, favor well maintained products, and follow how teams handle the shutdown and migration of legacy contracts.