Aztec Connect Drained of $2.1M Through Deprecated Contract Three Years After Shutdown

Total Funds Drained

$2.1M

Total amount drained from the Aztec Connect smart contract.

ETH Withdrawn

908.99 ETH

Amount of ETH withdrawn, valued at approximately $1.6 million.

Wrapped Staked ETH Withdrawn

167.89

Quantity of wrapped staked ETH withdrawn, valued at roughly $357,000.

§ 01 Executive Snapshot

What: $2.1 million drained from a deprecated Aztec Connect smart contract.
Who: Aztec Labs, an attacker utilizing a zero-knowledge proof vulnerability.
Why it matters: Highlights vulnerabilities in legacy smart contracts and the risks associated with abandoned blockchain projects.

An attacker exploited a flaw in the RollupProcessorV3 contract, leading to a $2.1 million loss from a deprecated contract three years after its shutdown.
The attacker withdrew approximately 908.99 ETH (around $1.6 million), 270,513 DAI, and 167.89 wrapped staked ETH (roughly $357,000).
Aztec Labs confirmed it has no ability to reverse the transactions due to the lack of admin keys over the deprecated system.

Aztec Connect was launched in July 2022 as a privacy-focused zk-rollup bridge but was deprecated in March 2023, leaving on-chain contracts unattended.
The incident reflects a broader trend of attacks on abandoned smart contracts in the crypto ecosystem, raising concerns about security measures for legacy systems.

Immediate consequence includes potential loss of user trust in legacy DeFi protocols and increased scrutiny on smart contract security practices.
Long-term implications may lead to a push for stronger regulatory frameworks around the management and oversight of deprecated blockchain contracts.

Potential risk includes regulatory scrutiny on protocols that leave legacy contracts unattended and unmonitored.
Technical risks arise from vulnerabilities in smart contracts that remain on-chain without active oversight, leading to potential exploitation.

Future developments to watch include security audits of existing smart contracts and measures taken by other DeFi protocols to secure legacy systems.
Monitoring for similar incidents across other deprecated contracts, as they may prompt industry-wide changes in how such contracts are managed.

§ 07

What happened to the Aztec Connect smart contract?

$2.1 million was drained from a deprecated Aztec Connect smart contract due to a vulnerability exploited by an attacker.

Who was responsible for the attack on Aztec Connect?

The attacker was utilizing a zero-knowledge proof vulnerability to exploit the RollupProcessorV3 contract.

Why is the incident significant for the crypto ecosystem?

It highlights vulnerabilities in legacy smart contracts and raises concerns about the security of abandoned blockchain projects.

What are the potential long-term implications of this incident?

It may lead to increased regulatory scrutiny and a push for stronger management practices for deprecated blockchain contracts.