DeFi bridge exploit drains over $2M

TLDR

A deprecated Aztec Network bridge contract was exploited, with the attacker stealing just over 2 million dollars worth of crypto.

1. Aztecs Private Rollup Bridge lost about 1,158 ETH, 150,000 DAI, and 0.47 renBTC, totaling roughly 2.15 to 2.16 million dollars, confirmed by SlowMist and PeckShield.
2. The exploit targeted a legacy, immutable bridge using a fake zero-knowledge proof, and followed a separate ~2.1 million dollar hack on another deprecated Aztec contract, bringing losses above 4 million dollars.
3. Current Aztec Network infrastructure and the AZTEC token are reported as unaffected, but the incident highlights serious risk from funds left in old DeFi and bridge contracts.

Deep Dive

1. What Was Exploited

Reports from SlowMist and Aztec Labs state that Aztecs deprecated Private Rollup Bridge was exploited for around 2.15 million dollars in assets, including 1,158 ETH, 150,000 DAI and 0.46 to 0.47 renBTC. The exploited contract is a payments or privacy bridge product that was launched earlier in the last cycle and later deprecated, but its smart contract remained live on Ethereum holding user funds. Security firms and media describe the attack as a single wallet exploiting the bridge in a short burst of transactions, initially funded with just 0.134 ETH from HitBTC before draining the bridge reserves.

2. Why It Failed And The Repeated Hacks

Analyses of the incident indicate the attacker abused the bridges "escape hatch" or emergency withdrawal path by submitting a fraudulent zero-knowledge proof that the contract incorrectly treated as valid, allowing unauthorized withdrawals from reserves. Because the bridge was an immutable rollup-style contract with no admin keys, Aztec Labs could not pause, upgrade, or patch it once deployed, leaving remaining funds exposed when a proof verification flaw was discovered. This exploit came only days after a separate ~2.1 million dollar drain from the deprecated Aztec Connect contract, also tied to weaknesses in zero-knowledge proof verification, bringing total losses across both incidents above 4 million dollars.

3. Impact On Users And What To Watch

Aztec Labs and the Aztec Foundation have stressed that the affected bridges are deprecated products and that the current Aztec Network and AZTEC ERC20 token are not technically linked to these contracts. However, the back-to-back exploits damage trust and illustrate that "dead" DeFi infrastructure can still be attacked if any value remains, especially when contracts are immutable and cannot be patched. For users, the practical lesson is to regularly exit deprecated bridges and protocols, monitor official migration or shutdown notices, and be cautious about leaving funds in old contracts that are no longer maintained.

Conclusion

This exploit fits a broader pattern where bridge and rollup infrastructure, especially legacy immutable contracts, remain a prime target for attackers because they hold pooled liquidity with limited upgrade paths. Even though the live Aztec ecosystem appears unaffected, the repeated hacks are a reminder that security risk in DeFi often comes from long-forgotten contracts rather than headline protocols, and careful management of where funds sit over time is critical.