Blockchain security firm SlowMist has disclosed a significant exploit targeting Aztec Network’s RollupProcessor contract, resulting in the theft of approximately 1,158 ETH, 150,000 DAI, and 0.4696 renBTC—totaling around $2.21 million USD.
The attack exploited the escapeHatch() function in the RollupProcessor contract at address 0x7379…2a2ba. According to SlowMist’s analysis, this function lacked essential access controls, such as an onlyOwner modifier, rollup provider authorization, or signature verification.
The TurboVerifier contract at 0x48cb…e8ce8 accepted escape hatch proofs even when rollupSize was set to zero. Consequently, the processDepositsAndWithdrawals() function trusted spoofed proofData public inputs—including publicOutput, outputOwner, and assetId—without validating actual fund ownership or withdrawal balances.
This vulnerability enabled the attacker’s externally owned account (0x6952…8e97f) to execute unauthorized withdrawals, including a direct drain of 1,158 ETH in a single transaction.
Aztec confirms incident involving deprecated product
Following the disclosure, Aztec Labs confirmed it was investigating a potential exploit affecting a deprecated Aztec Payments product launched in 2021. The team said approximately $2 million was transferred from the immutable smart contract, adding that the affected product is a Stage 2 rollup that was sunset in 2022.
Aztec Labs emphasized that it holds no administrative keys or control over the deprecated system, meaning the contract cannot be paused or upgraded. The company also clarified that the latest exploit is separate from the June 14, 2026 attack targeting the deprecated Aztec Connect product and said additional updates will be shared as the investigation progresses.
The incident highlights persistent risks in zero-knowledge proof verification and access control mechanisms within ZK-rollup architectures, even in active components of the protocol.
Aztec Network, a leading privacy-focused Ethereum ZK-rollup, has faced recent scrutiny. This exploit follows closely on the heels of a separate ~$2.19 million attack days earlier on its deprecated Aztec Connect RollupProcessorV3 contract, which was compromised via a ZK-rollup settlement boundary bypass. While the current network remains distinct, the repeated incidents underscore the long-tail risks associated with immutable smart contracts holding residual funds.
This Aztec breach represents the second DeFi exploit disclosed by SlowMist in hours. The first involved LittleBoyPlus being drained on BNB Smart Chain, where a flaw in the LBPHashrate._update() function allowed unauthorized token minting and a subsequent drain of roughly 377,642 USDT (~610 BNB) through PancakeSwap liquidity imbalances.
The events serve as a stark reminder for DeFi projects to prioritize rigorous audits, robust authorization logic, and ongoing monitoring of both active and legacy contracts to safeguard user assets in an evolving threat landscape.
