Aztec Connect exploit analysis

On June 14, 2026, Aztec Labs' deprecated Aztec Connect bridge was drained of about $2.1 million through a bug in the legacy RollupProcessor contract. The project had been deprecated roughly four years earlier, but the contract still held funds and was not pausable. Cointelegraph reported the loss; NewsBTC noted that the immutable RollupProcessorV3 contract was the affected code path.

How the drain worked

The RollupProcessorV3 contract processes deposits and withdrawals on the L1 side of the bridge. Aztec Labs said the project "holds no admin keys or control over the system; it cannot be paused or upgraded by us," which is the structural reason the bug remained exploitable. The exact mechanism of the first $2.1 million drain is described in less detail than the second one three days later, which SlowMist founder Cos published a preliminary analysis of.

Where the funds went

About 909 ETH were taken in this first exploit. The Aztec Foundation's statement was that there is no link between the affected contract and any smart contracts related to the current Aztec network or the AZTEC ERC-20 token. Aztec Labs clarified that the deprecated product was an immutable stage 2 rollup that was sunset in 2022, so even an emergency response from the original team was not technically possible.

Where it sits in the corpus

This is the first of two Aztec Connect drains within three days. The second hack, on June 17, took a similar $2.1 million via the same rollup processor. Together they make Aztec Connect one of three 2026 incidents in which the affected protocol had been shut down but the underlying contracts were still live and held user funds; the others are Raydium's deprecated AMM V3 and DxSale's locker. "Deprecated" turns out to mean "immutable" in practice.