What happened
On June 14, 2026, a deprecated Aztec Connect rollup contract on Ethereum was exploited for approximately $2.19 million.
Technical root cause
Aztec Connect did not cryptographically assert that the rollup proof side effects matched the deposit-and-withdrawal operations processed on L1, allowing malicious operations to pass settlement validation.
How it happened
The attacker submitted crafted rollups that caused the proof-verified state and the transaction list processed by the L1 settlement path to diverge, creating unbacked balances that could be withdrawn.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
