Rollup bridge exploit steals $2M in DeFi

TLDR

A deprecated Aztec Network bridge was exploited for about $2.1 million, underscoring how DeFi bridges and legacy rollup contracts remain prime attack targets.

1. Aztec Networks Private Rollup Bridge was drained of roughly 1,158 ETH, 150,000 DAI and renBTC, with total losses over $2 million confirmed by multiple security firms.
2. This was the second exploit of Aztec legacy infrastructure within days, both tied to flaws in zero?knowledge proof verification on immutable, deprecated contracts.
3. The active Aztec network and AZTEC token were not directly hit, but the event reinforces that users should be cautious with old bridges and avoid leaving idle funds in deprecated contracts.

Deep Dive

1. What Was Exploited

Reports show Aztec Networks deprecated Private Rollup Bridge on Ethereum was exploited, allowing an attacker to withdraw about 1,158 ETH, 150,000 DAI and 0.460.47 renBTC, worth a little over $2 million at the time of the attack.TokenPost and PeckShield highlight the same figures.

This bridge was an older payment or rollup product, launched around 2021 and sunset in 2022, but its smart contracts remained live and still held user funds.Cointelegraph notes Aztec held no admin keys and could not pause or upgrade the contract.

The exploit follows another Aztec legacy?contract hack a few days earlier, bringing combined losses from the two incidents to more than $4 million across deprecated systems.NullTX and CoinJournal both describe this pattern.

2. Why This Is So Serious

Security researchers attribute both exploits to weaknesses in zero?knowledge rollup proof verification on legacy Aztec infrastructure, not to stolen private keys or typical reentrancy bugs.NullTX and CoinJournal describe attackers using crafted ZK proofs and an escape hatch function to trigger withdrawals that the contract incorrectly treated as valid.

Because these contracts were immutable, Aztec Labs could not add checks, pause the bridge, or patch the bug after deprecation.Crypto.news and Cointelegraph emphasize that this is an industry?wide risk with abandoned DeFi infrastructure that still holds funds.

3. How Users Can Respond

Aztec and the Aztec Foundation stress that only deprecated products were affected and that the current Aztec network and AZTEC ERC?20 token contracts are separate.Crypto.news and CoinJournal both relay this clarification.

For users, the practical lessons are:

1. Treat bridges and rollup escape hatches as high?risk infrastructure, especially when they are legacy or no longer actively maintained.
2. Avoid leaving sizable idle balances in deprecated or frozen contracts, even if the project says they are safe but immutable.
3. Prefer bridges with clear, recent audits and transparent post?mortems after incidents, and monitor whether teams have practical controls to pause or migrate funds when bugs emerge.

Conclusion

The Aztec Private Rollup Bridge hack shows that even deprecated, done DeFi code can become a multi?million?dollar liability when it remains immutable and funded. The direct losses are modest versus total DeFi TVL, but the pattern of repeated bridge exploits, especially around complex ZK proof systems, is a clear signal that security and lifecycle management of rollup and bridge contracts remain critical points of failure for the ecosystem.