Aztec Network hacked again: attacker steals $2.2 million

Aztec Network has fallen victim to an exploit once again. The attacker exploited a vulnerability in the Private Rollup Bridge to steal a total of 1,158 Ethereum, 150,000 DAI, and 0.4696 renBTC. The total damage amounts to approximately $2.2 million. Security firms SlowMist and PeckShield have raised the alarm and shared details of the attack.

Ethereum is available at OKX and Bybit.

How the attack works

According to SlowMist, the root cause of the hack lies in the RollupProcessor.escapeHatch() function. This smart contract component lacks any form of access control: there is no onlyOwner protection, no authorisation via rollupProviders, and no provider signature verification. Because the TurboVerifier accepts an escape hatch proof when the rollupSize is zero, an attacker can submit fake public input.

The processDepositsAndWithdrawals() function then blindly trusts the public input from the proofData, without independently verifying that the sender actually owns the funds or has sufficient balance to withdraw. This allows the attacker to execute the command withdraw(1158 ETH, attacker, 0) and drain the entire contents of the RollupProcessor.

Attacker funded via HitBTC

PeckShield reports that the attacker’s address (0x6952d9246e9afe8b887b2877225163436f78e97f) was initially funded with 0.134 Ethereum originating from the exchange HitBTC. This is a common tactic where attackers obtain seed capital through an exchange to cover transaction costs before launching an attack.

At the time of the hack, the Ethereum price stood at $1.749,01. a decline of 0.8% over the past 24 hours. The stolen 1,158 ETH alone represents over $2 million in value. This is not the first time the Aztec network has faced a security incident, raising questions about the robustness of the smart contract audits within the protocol.