Aztec Network hit by second hack this week as escapeHatch drained of $2M

Aztec Network has been hit by another $2 million hack, its second this week.

Following Sunday’s $2.2 million loss from Aztec Connect, Aztec’s Private Rollup Bridge has now been drained of a similar amount.

The firm stressed, in both cases, that the affected contracts are “immutable” and were “deprecated” in 2022 and 2023.

Today’s incident brings the tally of bridge-related exploits this year to 14, with over $340 million lost in total.

Read more: Bridge hacks back in vogue as Verus exploit brings 2026 total to $329M

Security researcher Vishal Singh was first to flag the loss, which targeted the escapeHatch function of Aztec’s Private Rollup Bridge. The escapeHatch is an emergency measure which allows users to withdraw assets held on the rollup directly from Ethereum.

Yu Xian, founder of blockchain security firm SlowMist lists three suspicious transactions draining the Private Rollup Bridge. In all, around $2.15 million was drained as 1,158 ether, 150,000 DAI and 0.5 renBTC. 

He explains that, during the brief windows the hatch was “open,” anyone could trick the escapeHatch function into releasing the RollupProcessor-held funds by setting specific proofId and publicOutput parameters.

Read more: Rough weekend for DeFi: Four hacks, three outages, one warning

Double trouble

According to analysis from BlockSec, both Sunday’s and Thursday’s incidents, while not identical, were caused by “public input binding issues.”

Read more: Raydium’s old liquidity pools exploited for $1.3 million

The attack targeted Aztec’s RollupProcessorV3 contract, draining approximately $2.15 million of assorted crypto tokens.

DeFi protocols have faced a worrying tidal wave of attacks in recent months.

The hit rate appears to have dropped off somewhat in recent weeks, but the community braced itself for Anthropic’s Mythos release last week.

In the end, it turned out the model’s cybersecurity capabilities had been heavily “nerfed.”

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.