A Deprecated Crypto Protocol Just Lost $2.19M — And No One Could Stop It

 


Three years after Aztec Connect was officially shut down, someone walked off with $2.19 million from its smart contract on Ethereum. No alarm went off. No admin paused anything. That is because there are no admins. There is no pause function. The contract is immutable.

Security firm CertiK detected the suspicious transaction first. Wallet address 0x0f18d8b44a740272f0be4d08338d2b165b7edd17 drained the Aztec Connect router contract in a single move, pulling out LUSD, WETH, DAI, wstETH, and several other tokens in block 25315715.

CertiK then explained the technical flaw in a thread on X. The processRollupProof() function takes in a proof data payload. One internal function verifies part of it. A different function uses the middle of that same payload to actually move tokens. Those two parts are not cross-checked against each other. An attacker who controls what goes in the middle can push through unauthorized withdrawals while the verification step still passes.

Aztec Labs confirmed the incident and was direct about one thing: it cannot stop this. The team holds no admin keys over Aztec Connect. It cannot be paused. It cannot be upgraded. The contract runs exactly as deployed, forever, including when someone exploits it.

This is the part of crypto that does not get talked about enough. When a protocol says it is "deprecated," it usually means the team stopped maintaining it and shut the frontend down. It does not mean the contract is locked or the funds inside are safe. Millions of dollars can sit in unmaintained on-chain code for years, exposed to flaws nobody is looking for anymore.

If you used Aztec Connect between 2022 and 2023 and never confirmed your full withdrawal, now is the time to check. And if you hold positions in any other deprecated DeFi protocol from that cycle, the same logic applies.

For the full technical breakdown, the on-chain data analysis, and everything CertiK and Aztec Labs said publicly, read the complete article at CryptoNewsLive.org.

Read the full story on CryptoNewsLive.org

Comments

Post a Comment

Popular posts from this blog

Ripple's David Schwartz Just Ended the XRP Secret Plan Debate — Here's What He Said

Image
  David Schwartz, the former CTO and current board member at Ripple, made one of his most direct public statements yet on April 23, 2026. Speaking during a live X Spaces session and following up with a post on X under his handle @JoelKatz, Schwartz told the XRP community something many did not want to hear. There is no secret government plan. There is no hidden switch waiting to be flipped. And if you have been investing time, money, or emotional energy based on that belief, Schwartz said plainly, you are fooling yourself. That does not mean Ripple has no secrets. Schwartz was careful to separate the two things. Many of Ripple's partners do request NDAs. Business confidentiality is standard in fintech at that level. What Schwartz rejected is the jump from "NDAs exist" to "therefore a massive government intervention involving XRP is imminent." That jump, in his words, is almost always going to lead somewhere completely false. The post drew over 165,000 views a...
Read more

Ripple Is Building XRPL's Defense Against Quantum Computing, and the Clock Is Already Running

Image
  Ripple has released a detailed plan to protect the XRP Ledger from quantum computing threats, and the timeline it has set is not aspirational. The target is full post-quantum cryptography readiness by 2028, with active work already underway in 2026. The roadmap runs four phases. The first is an emergency contingency for a scenario where quantum computers break classical cryptography ahead of schedule. Ripple calls this Q-Day readiness. In that scenario, the XRP Ledger would enforce a hard network shift, stopping classical public-key signatures and requiring users to migrate to quantum-safe accounts. The second and third phases cover 2026. Testing begins on NIST-recommended post-quantum algorithms under real XRPL workload conditions. Performance, storage, and bandwidth costs all get measured. Then hybrid deployment begins on Devnet, running quantum-resistant signatures alongside existing ones before anything touches the live network. Project Eleven, an organization working on cr...
Read more

Hoskinson Just Said Everything Nobody Else Will Say About Crypto in 2026

Image
  Charles Hoskinson spent over an hour on the O Show with host Wendo in April 2026 and covered ground that most crypto founders avoid in public interviews. The Midnight Network mainnet went live on March 31 with nine institutional node operators including Google Cloud, MoneyGram, Worldpay, Telegram, Vodafone's Pairpoint, eToro, Bullish, Blockdaemon, and Shielded Technologies. That alone is a headline. But it was not the most important thing he said. The AI agent argument is where this interview breaks from the usual. His position is that zero-knowledge proofs are not primarily a privacy feature. They are the only mechanism by which AI agents can verify each other's behavior. When an autonomous agent is managing your funds across multiple blockchains while you sleep, it needs mathematical proof infrastructure underneath it to constrain what it can do, protect your data without exposing it, and settle value in real time without a middleman. Midnight is being built for that future...
Read more