On June 18, a hacker breached an unused smart contract on the Aztec L2 network. According to a preliminary estimate, the amount of damage is about $2.15 million. We are investigating a potential exploit affecting a deprecated Aztec payments product from 2021. ~$2m was transferred from the immutable smart contract in transaction: deprecated product is an immutable stage 2 rollup that was sunset in 2022.…— CertiK analysts were the first to notice the incident, after which the attack was confirmed by the Aztec Labs development team. The vulnerability was in the deprecated Aztec Payments payment product, which was shut down in 2022. The incident did not affect users or assets on the project's current network. According to researchers, the hacker exploited a vulnerability in the proof-verification logic of the PrivateRollupBridge smart contract. The attacker spent 0.134 ETH (~$230) to carry out the attack. In total, they managed to withdraw 1,158 ETH, 150,000 DAI and 0.47 renBTC. This is not the first security incident for Aztec in the past few days. On June 14, unknown actors drained another deprecated router contract for almost $2.19 million. Aztec Labs representatives noted that they do not hold administrative keys and do not control the system. Because of this, the team cannot freeze the contracts or release an update to prevent the attack. As a reminder, on June 8 hackers compromised wallets linked to the Humanity Protocol project. The damage was estimated at about $31 million.

Source: ForkLog