DeFi rollup bridge exploit steals $2M

TLDR

A deprecated Aztec Network bridge contract was exploited, with the attacker stealing roughly $2.12.2 million in crypto using a crafted zero-knowledge proof.

1. The exploit hit Aztecs old Private Rollup Bridge, draining about 1,158 ETH, 150,000 DAI, and 0.47 renBTC, worth just over $2 million.
2. It was the second Aztec-related exploit in days and stems from legacy, immutable contracts, not the current Aztec network or AZTEC token, but it still hurts trust.
3. The key things to watch are Aztecs post-mortem, how it handles remaining legacy contracts, and whether other rollup bridges review similar proof-verification designs.

Deep Dive

1. What Was Exploited And How

Reports from security firms and media say a hacker targeted Aztec Networks deprecated Private Rollup Bridge and withdrew around 1,158 ETH, 150,000 DAI, and 0.460.47 renBTC, totaling about $2.12.16 million in value at the time of the attack.Aztec bridge losses

Analyses from SlowMist and others describe the issue as a flaw in rollup proof verification combined with a vulnerable escape hatch or emergency withdrawal mechanism.ZK-proof flaw details The attacker submitted a specially crafted zero-knowledge proof that the contract incorrectly accepted as valid, triggering withdrawals as if they were legitimate user exits.SlowMist summary

2. Why It Matters For Users And DeFi

This exploit came just days after a separate $2.1 million drain from another deprecated Aztec product, Aztec Connect, bringing total losses from legacy Aztec contracts to more than $4 million.Two hacks in three days

Aztec Labs and the Aztec Foundation stress that the impacted contracts were old, immutable systems decommissioned years ago, and say there are no links between them and the current Aztec network or AZTEC ERC20 token.Foundation clarification That limits direct contagion but does not remove reputational damage, especially as both incidents share a root cause in zero-knowledge proof validation.

For DeFi broadly, this reinforces that bridges and rollup bridges holding parked liquidity remain high-value targets even after deprecation.

3. What To Watch Next

Aztec Labs says it is investigating and will release more detailed findings and recommendations on the exploit.Investigation update A key question is whether they can coordinate any recovery, mitigation for remaining funds, or user compensation.

More broadly, watch for:

1. Other rollup or bridge projects publicly reviewing their ZK proof binding and escape-hatch logic.
2. Any push toward forced migrations of assets from deprecated immutable contracts.
3. Changes in bridge usage and insurance or risk-premium discussions around ZK-based bridges.

Conclusion

The $2 million Aztec rollup bridge exploit is another reminder that the biggest risks in DeFi often sit in old, unmaintained contracts that still hold value. Even though Aztecs current network and token are reportedly unaffected, repeated proof-verification failures in deprecated code raise hard questions about how rollup and bridge projects sunset infrastructure and protect residual user funds.