Aztec Network has suffered another security incident. Attackers exploited a flaw in the protocol's emergency withdrawal mechanism to transfer approximately $2.21 million in digital assets from the RollupProcessor contract. The transferred assets included 1,158 ETH, 150,000 DAI, and 0.4696 renBTC.
The problem lies in the emergency withdrawal function.
The core of this attack lies in RollupProcessor.escapeHatch(). This function was originally intended to provide users with an emergency exit channel when the regular Rollup process fails.
However, the article states that this path lacks several key security restrictions, including authorization checks on the Rollup provider, restrictions on owner-only calls, and signature verification. As a result, external addresses can also call this workaround path.
Withdrawal completed after forging documents
The attacker exploited the specific condition that `rollupSize` was set to 0 to force the protocol's `TurboVerifier` contract to accept an escape hatch proof. Once the proof passed, the `processDepositsAndWithdrawals()` function executed withdrawals based solely on the publicly available inputs in the proof.
- assetId
- Payment address: outputOwner
- Withdrawal amount, Publ token issuance, Uput
The problem is that the contract lacks an independent verification of whether the receiving address is entitled to the assets, and it also fails to check whether the withdrawal request corresponds to a genuine user's balance. Attackers can therefore construct a seemingly valid proof, fill in forged public parameters, and ultimately transfer funds to an externally controlled address.
An unusual transfer occurred just three days ago.
Just three days ago, Aztec Network's Router contract also suffered a loss of approximately $2.19 million. The relevant transactions occurred on the Ethereum blockchain, involving addresses 0x0f18....edd17.
Both incidents point to the same problem: the protocol lacks sufficient independent verification of on-chain inputs when validating proof data, and access controls are flawed. Even without actual ownership of the assets, attackers could potentially use seemingly valid proofs to complete withdrawals.
Additional information:The article mentions that, according to its statistics, the amount stolen from the crypto industry so far in 2026 has reached $812.15 million, with the highest single-month amount in April, reaching $634.85 million.
