- Joined
- Jan 20, 2026
- Messages
- 345
- Reaction score
- 2,308
Immutability is sacred. Especially when the hacker is inside.
In the old crypto service Aztec Connect found a possible exploit: about $ 2.1 million were withdrawn from an unchangeable smart contract. Aztec Labs reported the investigation of the incident and pointed out the transaction in Ethereum, where the funds withdrew from the contract of Aztec: Connect to the address, which Etherscan already notes as the Aztec Exploiter 1.
The transaction was held on June 14. The contract was withdrawn 908.9867 ETH, as well as several ERC-20 tokens, including DAI, wstETH, yvDAI, yvWETH, LUSD and yvLUSD. Among the largest translations, Etherscan shows 270 513 DAI and 167.89 wstETH. The total amount of Aztec Labs is estimated at about $ 2.1 million.
Aztec Connect was a service for confidential operations in Ethereum. The protocol used zero-disclosed evidence so that users could interact with DeFi services without disclosing all details of transactions on the public network. The Aztec team decommissioned Aztec Connect three years ago and warned users about the need to withdraw funds.
The main problem for affected users is that the contract of Aztec Connect is immutable. Aztec Labs says it does not store admin keys or control the system, so the team cannot pause contract, update the code, or roll back suspicious operations. The immutability of a smart contract protects the protocol from manual intervention, but with the vulnerability found, deprives developers of emergency levers.
Aztec Labs has promised to publish new data after verification. So far, the company has not disclosed the technical cause of the possible exploit and said whether the incident affected users who left the funds in the old infrastructure after the closure of Aztec Connect.
In the old crypto service Aztec Connect found a possible exploit: about $ 2.1 million were withdrawn from an unchangeable smart contract. Aztec Labs reported the investigation of the incident and pointed out the transaction in Ethereum, where the funds withdrew from the contract of Aztec: Connect to the address, which Etherscan already notes as the Aztec Exploiter 1.
The transaction was held on June 14. The contract was withdrawn 908.9867 ETH, as well as several ERC-20 tokens, including DAI, wstETH, yvDAI, yvWETH, LUSD and yvLUSD. Among the largest translations, Etherscan shows 270 513 DAI and 167.89 wstETH. The total amount of Aztec Labs is estimated at about $ 2.1 million.
Aztec Connect was a service for confidential operations in Ethereum. The protocol used zero-disclosed evidence so that users could interact with DeFi services without disclosing all details of transactions on the public network. The Aztec team decommissioned Aztec Connect three years ago and warned users about the need to withdraw funds.
The main problem for affected users is that the contract of Aztec Connect is immutable. Aztec Labs says it does not store admin keys or control the system, so the team cannot pause contract, update the code, or roll back suspicious operations. The immutability of a smart contract protects the protocol from manual intervention, but with the vulnerability found, deprives developers of emergency levers.
Aztec Labs has promised to publish new data after verification. So far, the company has not disclosed the technical cause of the possible exploit and said whether the incident affected users who left the funds in the old infrastructure after the closure of Aztec Connect.
