Aztec Connect's proof verification failed to match L1 state updates, letting attacker submit unvalidated transactions crediting themselves with value. They withdrew $2.1M in ETH, DAI, wstETH and other tokens.

An attacker exploited a vulnerability in the incomplete proof verification logic of the deprecated Aztec Connect Router contract on Ethereum, draining approximately $2.1 million in assets. The protocol had been deprecated for three years with no team control over the immutable contract. The current Aztec Network and AZTEC token were unaffected.