The Aztec Connect $2.1M Exploit: Root Cause and ZK
Published 6/15/2026, 2:09:14 PM
The Aztec Connect exploit occurred on June 14, 2026, draining approximately $2.1–2.15 million from the deprecated RollupProcessorV3 contract on Ethereum. The root cause was a smart contract logic vulnerability, not a flaw in ZK proof cryptography itself.
Root Cause: Verification-Settlement Logic Mismatch
The core vulnerability was a discrepancy between how the ZK proof system verified transactions and how the settlement logic processed them on-chain:
- The proof system and settlement logic read the transaction list differently
- The attacker exploited this gap to create balances not backed by valid value on Ethereum
- These unbacked balances passed through settlement and were successfully withdrawn
Technical Attack Vector (per BlockSec's Phalcon team analysis):
- Attacker placed real deposit transactions in later slots of the rollup
- Attacker set
numRealTxsto a smaller value than actual - Settlement logic skipped processing certain slots while the proof system had already verified them
- Attack was repeated 7 times across multiple assets
Financial Impact
| Asset | Amount Stolen | Estimated Value |
|---|---|---|
| ETH | 909 ETH | ~$2.1M |
| DAI | ~270,000 DAI | ~$270K |
| wstETH | 167 wstETH | ~$670K |
| Total | — | ~$2.1–2.15M |
Attacker Address: 0x0f18d8b44a740272f0be4d08338d2b165b7edd17
- Funded via Tornado Cash prior to exploit
Protocol Context
| Aspect | Details |
|---|---|
| Product | Aztec Connect — privacy-focused zkRollup for DeFi |
| Deprecation | March 31, 2023 |
| Contract Status | Fully immutable — no admin keys, cannot be paused or upgraded |
| Aztec Labs Control | None — cannot intervene |
| Current Aztec Network | Unaffected |
| AZTEC Token | Unaffected |
Is ZK Proof Security at Risk?
Yes, but the risk is more nuanced than pure cryptography:
- Cryptographic soundness of ZK proofs remains intact — the exploit didn't break ZK math
- Implementation risk is the real danger: circuit logic, verification code, and settlement code must all align perfectly
- This is a systemic risk for all ZK rollups, not just Aztec — any mismatch between proof verification and settlement creates exploitable vectors
The incident underscores that ZK rollup security requires continuous auditing even after deprecation, rigorous constraint analysis beyond basic circuit logic, and clear timelines for user fund withdrawal before admin key renunciation.
Claims Resolution
| Claim | Status | Notes |
|---|---|---|
| c1: Exploit caused by smart contract vulnerability, not ZK cryptography flaw | Supported | Evidence confirms verification-settlement logic mismatch (smart contract issue), not ZK proof breakage |
| c2: claimDistributions function lacking access control | Not supported | Evidence describes a verification-settlement mismatch, not an access control vulnerability. No mention of claimDistributions function in available data |
| c3: ZK proof security not broadly at risk; vulnerability was in contract logic | Partially supported | Evidence confirms ZK proof verification remained intact and the vulnerability was in settlement logic, but the claim somewhat conflates these two distinct aspects |
Key Risks Exposed
-
Verification-Settlement Disconnect: Even valid ZK proofs can result in invalid on-chain state if contract logic doesn't interpret proof data identically. One contract function verified only the beginning of the proof; token transfer instructions embedded elsewhere were not properly checked.
-
Immutable Contract Risk: Once admin keys are renounced, no response is possible even if vulnerabilities are discovered later. The "ghost ship problem" means deprecated contracts holding residual funds remain attack targets years after shutdown.
-
Legacy System Exposure: The RollupProcessorV3 had been immutable since protocol shutdown in March 2023 — attackers waited over 3 years to exploit.
Prior ZK Circuit Bug (Separate Incident)
A distinct ZK circuit bug was discovered by researcher lucash-dev via Immunefi in September 2022:
- Bug: Integer arithmetic flaw — top limb constrained to 68 bits, but remainder had NO range constraints
- Bug Bounty: $450,000 (Aztec's largest ever) [Source: https://www.aztec.xyz/blog/zk-circuit-bug-disclosure]
- Fix: Added constraints on remainder values and direct mapping between original values and decomposed counterparts
This was a separate issue from the 2026 exploit and was patched in 2022.
Conclusion
The Aztec Connect $2.1M exploit was caused by a smart contract logic vulnerability (verification-settlement mismatch), not a flaw in ZK proof cryptography itself. ZK proof security as a technology is not broadly at risk from this incident — the cryptographic verification remained sound. However, the incident highlights that implementation risk (alignment between proof verification and on-chain settlement) is a systemic concern for all ZK-based systems.
What remains open: The specific technical details of how the attacker constructed the malicious proofs to exploit the settlement gap, and whether similar verification-settlement mismatches exist in other ZK rollup implementations.
Suggested next steps:
- Audit other ZK rollup contracts for verification-settlement logic alignment — the Aztec exploit demonstrates this is a systemic risk across the ecosystem, not an isolated incident
- Monitor the attacker address (
0x0f18d8b44a740272f0be4d08338d2b165b7edd17) for fund movement patterns, as law enforcement追踪 typically follows fund consolidation