Worked example · 2026-06

Aztec deprecated rollup infrastructure — forged rollup proofs drain two immutable, abandoned bridges within a week — Ethereum — 2026-06 (≈06-14 and ≈06-17) (cohort)

Loss: ~$4.3M realised combined across two separate exploits of long-deprecated Aztec products in a single week, each via a falsified rollup proof that tricked an immutable contract into releasing assets from its reserves:
OAK Techniques observed: OAK-T10.002 (Message-Verification Bypass — the load-bearing on-chain primitive in both incidents: a falsified rollup proof satisfied the bridge's withdrawal/emergency-exit verification and released reserves with no legitimate L2 state behind it. Per SlowMist, the bridge's emergency-withdrawal mechanism allowed an attacker to manipulate proof data and withdraw funds that should not have been released. This is the forged-proof / proof-data-manipulation shape of T10.002, kin to Syscoin's parser misread and Hyperbridge's MMR-proof reuse, distinct from Taiko's leaked-attestation-key shape. See techniques/T10.002-message-verification-bypass.md). OAK-T11.013 (Legacy-Version Maintenance Attack Surface — the structural precondition and the reason this is a cohort: two products Aztec had deprecated years earlier (2022 and 2023) were left deployed, value-holding, and unmonitored, and were exploited via their own residual withdrawal logic. Aztec is a sharper sub-shape than the GMX-V1 anchor — not deprecated-but-maintained-unfixed but deprecated-AND-immutable-AND-abandoned: the operator could not backport a fix or pause even in principle, because the contracts are immutable and admin access was relinquished. This is the custody/abandoned-reserve variant shared with the DxSale legacy-locker anchor — value parked in immutable legacy code that nobody can defend. See techniques/T11.013-legacy-version-maintenance-attack-surface.md). The chain is T11.013 (immutable, abandoned, value-holding legacy bridge) → T10.002 (forged rollup proof → unbacked reserve withdrawal).
Attribution: pseudonymous. The exploits and the forged-proof root cause were disclosed by SlowMist (co-founder Cos shared preliminary findings) and confirmed in substance by Aztec Labs, which stressed the contracts' immutability and separation from the current network. No named actor or group; the two incidents within one week are consistent with the same class of opportunistic targeting of abandoned reserves but are not, on public evidence, confirmed to be the same actor. First incident (Aztec Connect) landed ~2026-06-14/15; second (Private Rollup Bridge) ~2026-06-17.
Key teaching point: Deprecating a contract is not decommissioning it — and an immutable contract you can no longer control is an attack surface you can never patch or pause. Aztec did the development-roadmap part of deprecation (moved to the next-generation network, told users the old products were closed) but left value-holding immutable bridges live on mainnet with no admin, no monitoring, and no ability to intervene. When a forged-proof flaw in their residual withdrawal logic was found, there was no lever to pull — no pause, no upgrade, no freeze — and the only honest response was a public statement that the team is powerless over the contract. The defender lessons: (1) a deprecation plan must include a decommission plan — drain or migrate residual reserves out of legacy contracts and reduce their balances to zero, because a legacy contract holding zero value cannot be exploited; (2) immutability is a double-edged property — it removes upgrade-key risk but also removes every emergency control, so immutable contracts must ship with their own built-in circuit-breakers (rate limits, exit caps) since no operator action can be added later; (3) monitor abandoned deployments you can no longer control — at minimum, watch their balances and withdrawal events so an exploit is detected even when it cannot be stopped. Aztec is OAK's cleanest anchor for the immutable-abandoned-legacy sub-shape of T11.013, and a paired demonstration that the same residual surface can be hit twice in a week once attackers know the reserves are undefended.

Aztec Connect (deprecated March 2023) — ~$2.1M drained (~mid-June 2026).
Aztec Private Rollup Bridge (launched 2021, closed 2022) — ~$2.16M drained: 1,158 ETH, 150,000 DAI, 0.46 renBTC (~2026-06-17).

Both contracts are immutable: Aztec Labs stated they cannot be modified, paused, or controlled by the team, which no longer holds administrative access to the impacted infrastructure, and emphasised that these legacy products are separate from the current Aztec Network and its AZTEC ERC-20 token. The realised loss is the assets that remained parked in these abandoned reserves; the notional ceiling for each is simply whatever was still held, since a forged-proof withdrawal primitive is bounded only by the contract's balance and the (absent) ability of anyone to halt it.

Summary

Aztec is a privacy-focused Ethereum scaling project. Two of its earlier products had been deprecated years before 2026: the Private Rollup Bridge (launched 2021, closed 2022) and Aztec Connect (a privacy-focused rollup product, deprecated March 2023). Development moved on to the next-generation Aztec Network and its AZTEC token, but the legacy contracts remained deployed on Ethereum mainnet, immutable, and still holding user reserves.

In mid-June 2026, attackers exploited both within roughly a week. In each case the mechanism was a falsified rollup proof: the attacker manipulated proof data so the contract's withdrawal / emergency-exit verification accepted it as legitimate and released assets from reserves with no real L2 state behind the withdrawal. The Private Rollup Bridge drain (~~2026-06-17) removed 1,158 ETH, 150,000 DAI, and 0.46 renBTC (~~$2.16M); the Aztec Connect drain days earlier removed ~$2.1M.

SlowMist disclosed the technical root cause; Aztec Labs confirmed the exploit and underscored the defining constraint — the contracts are immutable and outside the team's control: "the contract is immutable, which means that it cannot be modified, paused, or controlled by the team," and the products are separate from the current Aztec Network and AZTEC ERC-20 token. The team therefore could neither pause the bridge nor recover the funds.

Timeline (UTC)

When	Event	OAK ref
2021	Aztec Private Rollup Bridge launched	—
2022	Private Rollup Bridge closed/deprecated; left deployed, immutable, value-holding	T11.013 standing surface
2023-03	Aztec Connect deprecated; likewise left deployed, immutable, value-holding	T11.013 standing surface
~2026-06-14/15	Aztec Connect exploited via a falsified rollup proof; ~$2.1M drained from reserves	T11.013 → T10.002 execution (1)
~2026-06-17	Private Rollup Bridge exploited via a falsified rollup proof; 1,158 ETH + 150,000 DAI + 0.46 renBTC (~$2.16M) drained	T11.013 → T10.002 execution (2)
2026-06	SlowMist (Cos) discloses forged-proof / proof-data-manipulation root cause; Aztec Labs confirms, states contracts are immutable and uncontrolled, separate from current network	(forensics + operator response)

What defenders observed

Pre-event (residual value in abandoned immutable contracts). Both losses trace to reserves left in deprecated-but-not-decommissioned contracts that were immutable and unmonitored. The control is a decommission discipline: migrate/drain legacy reserves to zero, and treat any value-holding deprecated deployment as live attack surface for as long as it holds a balance (OAK-T11.013 mitigation surface).
At-event (forged-proof withdrawal with no backing state). The on-chain signature is a withdrawal/emergency-exit that does not correspond to any legitimate rollup state — the canonical T10.002 "release without a backing event" indicator. A reserve-balance + withdrawal-event monitor on the abandoned contracts would have detected the drain even though, given immutability, it could not have stopped it.
At-event (no controllable circuit-breaker). Because the contracts are immutable with no admin, there was no pause or freeze available — the second exploit landing days after the first underscores that an undefended, value-holding legacy contract stays exploitable until its balance is gone. Immutable contracts must therefore carry built-in withdrawal caps/rate limits, since none can be added post-deployment.
Post-event (honest powerlessness disclosure). Aztec's statement — immutable, uncontrolled, separate from the current network — is the accurate operator posture, but it is a disclosure of inability to respond, not a containment action. The teaching value is precisely that decommission must happen before abandonment, because after it there is no response left.

Public references

[coinpaperaztec2026] — Coinpaper, "Aztec Suffers Second $2.15M Exploit in Less Than a Week" (second exploit Thursday 2026-06-18 framing; Aztec Connect deprecated March 2023; Private Rollup Bridge deprecated 2022; falsified rollup proof releasing reserves; 1,158 ETH / 150,000 DAI / 0.46 renBTC; SlowMist co-founder Cos; Aztec Labs "immutable… cannot be modified, paused, or controlled"): https://coinpaper.com/32030/aztec-suffers-second-215m-exploit-in-less-than-a-week
[tronweeklyaztec2026] — TronWeekly, "Aztec Network Exploit: $2.16M Drained From Deprecated Bridge" (Private Rollup Bridge drain; SlowMist disclosure; falsified rollup proof; emergency-withdrawal proof-data manipulation): https://www.tronweekly.com/aztec-network-exploit-2-16m-drained-from/
[coinlawaztec2026] — Coinlaw, "Aztec Hit by Second $2.1M Hack in Days as Bridge Drained" (two incidents within days; deprecated infrastructure; immutable contract framing): https://coinlaw.io/aztec-second-2-1m-hack-private-rollup-bridge/
[coinpediaaztec2026] — Coinpedia, "Aztec Hit Again: Another $2.16 Million Drained Just Days After Previous Exploit" (sequence of the two exploits; amounts; deprecated/immutable framing): https://coinpedia.org/news/aztec-hit-again-another-2-16-million-drained-just-days-after-previous-exploit
[coinalertnewsaztec2026] — CoinAlertNews, 2026-06-15, "Aztec Connect Exploit Drains $2.1M from Deprecated Ethereum Bridge" (first incident; Aztec Connect deprecated 2023; ~$2.1M; deprecated-bridge framing): https://coinalertnews.com/news/2026/06/15/aztec-connect-exploit-2-million

Discussion

Aztec is the second clean 2026 anchor for OAK-T11.013 and sharpens the technique past its GMX-V1 origin. GMX V1 was deprecated-but-maintained: the operator could have backported a fix and chose not to, accepting the residual risk. Aztec is deprecated-and-immutable-and-abandoned: the operator could not fix or pause even if it wanted to, because the contracts are immutable and admin was relinquished, and the residual reserves were left exposed for years. This is the same custody/abandoned-reserve shape as the DxSale legacy-locker case — value parked in immutable legacy code that nobody defends — and it is arguably the more dangerous T11.013 sub-shape precisely because immutability removes every post-hoc control. Contributors should record, per T11.013 incident, whether the legacy deployment is mutable (a fix/pause was possible but skipped) or immutable (no fix/pause was ever possible), because the mitigation diverges: the former calls for backporting discipline, the latter for draining reserves to zero before abandonment and for shipping immutable contracts with built-in circuit-breakers.

It is also a T10.002 reminder that the forged-proof primitive is class-stable across very different proving stacks: Syscoin (SPV parser), Hyperbridge (MMR-proof reuse), Taiko (leaked SGX attestation key), and Aztec (manipulated rollup proof data in an emergency-exit path) are all the same failure — a contract released assets against a proof it should have rejected — differing only in which layer of the proof pipeline broke. The pairing of two Aztec drains in one week is the operationally important detail: once attackers learned that a value-holding contract had a forged-proof flaw and no defender could intervene, the only bound on further loss was the reserve balance itself.