What happened
On June 17, 2026, the legacy Aztec Private Rollup Bridge on Ethereum was drained of approximately 1,158 ETH, worth about $2.15 million.
Technical root cause
The claim-proof and verifier path failed to bind the withdrawal recipient to the legitimate note owner, allowing attacker-controlled output data to pass the escape-hatch flow.
How it happened
The attacker called the bridge's escapeHatch with a crafted proof that directed the full payout to the attacker's wallet, draining the remaining bridge balance in one transaction.
Protocol details
Classification
Bridge & Cross-Chain / Other
Protocol Type
Exploit/Other
Category
Bridge Hack
Implementation language
Solidity
Protocol links
Website
@aztecnetwork
Attacker Address
0x6952d9246e9afe8b887b2877225163436f78e97f
Exploit Transaction
0xab306cd2184d23b6ba…b17a59c2b5
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
