Aztec's private rollup bridge escape-hatch mechanism was exploited via incomplete proof validation, allowing an attacker to manipulate proof data and withdraw 1,158 ETH, 150,000 DAI, and ~0.47 renBTC. This was the second Aztec exploit in June 2026; the June 14 attack drained ~$2.1M via similar proof manipulation.

On June 17, 2026, attackers exploited Aztec’s deprecated Private Rollup Bridge (launched in 2021 and shut down in 2022). They abused an immutable escape-hatch function that lacked proper ownership checks, using manipulated or fake rollup proofs to withdraw assets without corresponding deposits. Approximately $2.16 million (1,158 ETH, 150,000 DAI, and 0.47 renBTC) was drained. Aztec Labs confirmed the affected contract is unrelated to the current Aztec Network or the AZTEC ERC-20 token and that they have no control over the immutable old contracts.