•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
•
Aztec Labs said it is investigating a potential exploit that affected a deprecated Aztec payments product from 2021, after roughly $2 million was reportedly moved from an immutable smart contract on Ethereum.
In a post, Aztec Labs said the activity involved an immutable stage 2 rollup that was sunset in 2022. The company said about $2 million was transferred from the contract in an Etherscan transaction dated June 17.
Aztec Labs also said it holds no admin keys or control over the system, meaning it cannot pause or upgrade the old contract.
The Aztec Foundation said it was made aware of the possible exploit on June 17. In its statement, the Foundation said there are “no links” between the deprecated product and any smart contracts tied to the current network or the AZTEC ERC20 token.
The Foundation also said the product was deprecated four years ago and that Aztec Labs no longer controls the system. It directed users to Aztec Labs for updates as the team reviews the transaction and the affected contract.
Aztec Labs said the June 17 case is separate from a June 14 exploit involving Aztec Connect, another deprecated product. In that earlier incident, Aztec Connect reportedly lost $2.1 million after an old immutable smart contract was exploited.
According to a prior report, the Aztec Connect attack involved a verification mismatch that allowed unbacked balances to move through Ethereum settlement records, with security firms later tracing the issue to an old RollupProcessorV3 contract.
The new case highlights a risk for discontinued DeFi products: even after a product shuts down, its contracts can remain live on Ethereum. If funds remain inside immutable contracts, attackers may still look for ways to move them.
Aztec Labs said it will share further updates “in due course,” while both Aztec Labs and the Aztec Foundation emphasized that the incident concerns a deprecated system rather than the active Aztec network or the AZTEC token.
Ready Card users outside the European Economic Area have reportedly faced an abrupt service halt after a transition involving the card issuer disrupted the USDC spending product, according to user notices shared on X.
A notice shared…
