Aztec has suffered another security incident, this time affecting an outdated payment product that has long been discontinued. Attackers used forged rollup proofs to transfer 1,158 ETH, 150,000 DAI, and 0.46 renBTC from the protocol reserves, with estimated losses of approximately $2.15 million, according to reports.

The affected contracts were discontinued in 2022.

Aztec Labs confirmed that the smart contract exploited belonged to a payment product that was deprecated in 2022. The team stated that the contract was immutable, meaning it could neither be paused nor modified, and that the team no longer holds the management key that could interfere with its operation.

This means that although the relevant products have long been discontinued, the on-chain contracts still exist, and the assets within them could still be targets of attacks. This incident also exposes once again that legacy infrastructure can still leave long-term risks even after maintenance has ceased.

A similar incident happened just a few days ago.

Just days ago, another Aztec privacy rollup product, Aztec Connect, was also attacked, resulting in a loss of approximately $2.1 million. This product was officially discontinued in March 2023. Following the incident, Aztec suspended new investments and shifted its development focus to the next-generation Aztec Network.

However, although the product has been discontinued, some historical user funds remain in the old contracts, leaving room for attackers to exploit. These two consecutive incidents have also brought renewed market attention to the security of assets left behind in deactivation agreements.

Security agencies warn of risks associated with old contracts

Several security research institutions have pointed out that once deactivated contracts remain on the blockchain and still contain assets, they may become long-term targets for hackers. Risk analysis platform Blockful recently warned that after a project ceases maintenance, old contracts often become "open targets" for attackers.

In its post-mortem analysis, SlowMist also noted that leaving legacy assets within abandoned contracts for an extended period would continuously amplify security exposure. Their recommendation is that projects should develop a clear asset migration plan simultaneously when decommissioning older products, transferring funds to new infrastructure as quickly as possible.

• The stolen assets included 1,158 ETH, 150,000 DAI, and 0.46 renBTC.
• The previous incident involved Aztec Connect, resulting in losses of approximately $2.1 million.
• Both incidents were related to old contracts that had been discontinued but still contained assets.