Blockchain security firm SlowMist has disclosed a significant exploit targeting Aztec Network’s RollupProcessor contract, resulting in the theft of approximately 1,158 ETH, 150,000 DAI, and 0.4696 renBTC—totaling around $2.21 million USD.
The attack exploited the escapeHatch() function in the RollupProcessor contract at address 0x7379…2a2ba. According to SlowMist’s analysis, this function lacked essential access controls, such as an onlyOwner modifier, rollup provider authorization, or signature verification.
The TurboVerifier contract at 0x48cb…e8ce8 accepted escape hatch proofs even when rollupSize was set to zero. Consequently, the processDepositsAndWithdrawals() function trusted spoofed proofData public inputs—including publicOutput, outputOwner, and assetId—without validating actual fund ownership or withdrawal balances.
At the time of publication, Aztec team has not shared anything regarding the exploit.
This vulnerability enabled the attacker’s externally owned account (0x6952…8e97f) to execute unauthorized withdrawals, including a direct drain of 1,158 ETH in a single transaction.
The incident highlights persistent risks in zero-knowledge proof verification and access control mechanisms within ZK-rollup architectures, even in active components of the protocol.
Aztec Network, a leading privacy-focused Ethereum ZK-rollup, has faced recent scrutiny. This exploit follows closely on the heels of a separate ~$2.19 million attack days earlier on its deprecated Aztec Connect RollupProcessorV3 contract, which was compromised via a ZK-rollup settlement boundary bypass. While the current network remains distinct, the repeated incidents underscore the long-tail risks associated with immutable smart contracts holding residual funds.
This Aztec breach represents the second DeFi exploit disclosed by SlowMist in hours. The first involved LittleBoyPlus being drained on BNB Smart Chain, where a flaw in the LBPHashrate._update() function allowed unauthorized token minting and a subsequent drain of roughly 377,642 USDT (~610 BNB) through PancakeSwap liquidity imbalances.
The events serve as a stark reminder for DeFi projects to prioritize rigorous audits, robust authorization logic, and ongoing monitoring of both active and legacy contracts to safeguard user assets in an evolving threat landscape.
This is a developing story and more information will be added as the event unfolds.
