Aztec Connect Exploit Drains $2.1 Million From Deprecated DeFi Platform

A hacker stole approximately $2.1 million from Aztec Connect, a decentralized finance platform that was discontinued in March 2023 but still held crypto assets in its immutable smart contract. The incident occurred on June 15 and involved a flaw in the platform’s transaction verification process.

Aztec Labs confirmed it was investigating the exploit and said the attack did not impact users or assets on the current Aztec Network. The stolen funds were taken from the older Aztec Connect system, which can no longer be upgraded or paused.

Verification Flaw Allowed Unauthorized Withdrawals

According to blockchain security researcher BlockSec, the attacker exploited a mismatch between transaction verification and settlement on Ethereum. This allowed the creation of balances that were not properly backed by assets, making withdrawals possible without full validation.

The attacker reportedly carried out the exploit seven times across multiple assets, stealing 909 Ether, 270,000 DAI, 167 wrapped staked Ether and other cryptocurrencies.

Abandoned DeFi Protocols Remain Security Risks

Aztec Connect launched in 2022 as a DeFi bridge before being phased out in 2023. Since the smart contracts are fully immutable and outside the team’s control, the incident highlights how abandoned DeFi protocols can remain attractive targets for attackers years after their shutdown.