Aztec Connect, a deprecated privacy-focused DeFi platform, has been drained of roughly $2.1 million after an attacker exploited a flaw in its transaction-verification logic.
Aztec Labs said around $2.1 million was transferred from the platform's deprecated smart contract. The team stressed that the incident did not affect users or assets on the current Aztec network.
According to blockchain security firm SlowMist, the attacker exploited a mismatch between how the platform verified transactions and how they were settled on Ethereum. Verified transactions on Aztec Connect's contract were not effectively bound to the transaction set enforced by its zero-knowledge proof.
SlowMist noted that the exploit echoed an earlier hack of the platform, which had taken advantage of a similar weakness.
Aztec Connect had already been wound down, and the affected contract was deprecated — meaning active users of the current network were not at risk.
A reminder of smart contract risk
The incident adds to a long list of DeFi exploits that target the gap between a protocol's cryptographic proofs and its on-chain settlement. Even deprecated contracts can remain vulnerable if funds or permissions are left accessible.
Security researchers continue to urge teams to fully retire and drain old contracts, and to treat zero-knowledge verification logic with particular care given its complexity.