Incident Summary
Published 6/22/2026, 1:33:17 AM
In mid-June 2026, Thetanuts Finance and Aztec Network suffered security incidents resulting in a combined loss of approximately $4.3 million. Both attacks targeted "zombie contracts"—legacy or deprecated infrastructure that had been sunset or migrated years prior but remained active on-chain.
Incident Summary
| Protocol | Date (2026) | Amount Lost | Primary Vulnerability | Status of Funds |
|---|---|---|---|---|
| Thetanuts Finance | June 15 | ~$2.1M | Integer division truncation flaw | ~$2.0M recovered; ~$134k net loss |
| Aztec Network | June 14 | ~$2.19M | Proof verification gap (Aztec Connect) | Total loss; immutable contracts |
| Total | ~$4.29M |
1. Thetanuts Finance: Legacy Vault Exploit
The exploit targeted a deprecated vault that was no longer part of the protocol's active product suite [Source: https://www.archax.com/news/thetanuts-finance-and-aztec-network-security-incidents].
- The Mechanics: The attacker exploited an integer division truncation flaw in the vault's redemption logic. By manipulating the
totalSupplyto nearly zero, the attacker caused the formulabacking * amount / totalSupplyto return zero, allowing for the minting of "free" option tokens [Source: https://www.archax.com/news/thetanuts-finance-and-aztec-network-security-incidents]. - Recovery: Following the breach, white-hat hackers and security firms (including Blockaid and PeckShield) successfully recovered approximately $2.0 million in option tokens. The final net loss was reduced to roughly $134,000, primarily consisting of 60 ETH [Source: https://www.archax.com/news/thetanuts-finance-and-aztec-network-security-incidents].
2. Aztec Network: Aztec Connect Bridge Drain
This incident targeted Aztec Connect, a privacy bridge that had been officially sunset in March 2023.
- The Mechanics: The vulnerability stemmed from a mismatch between the verified rollup transaction set and the L1 settlement processing. The
computeRootHashes()function only validated the beginning of the proof data, while critical token transfer parameters were located in an unverified middle section [Source: https://aztec.network/blog/june-2026-incident-report]. - The Attack: The attacker submitted 14 crafted rollup submissions in a single transaction, creating unbacked balances. This allowed the withdrawal of 909 ETH, 270k DAI, and 167 wstETH [Source: https://aztec.network/blog/june-2026-incident-report].
- The "Immutable" Constraint: Because Aztec Labs had renounced all administrative roles and keys in April 2024 to achieve full decentralization, the team had no technical ability to pause the contracts or patch the code once the drain began [Source: https://twitter.com/aztecnetwork/status/1782091895].
Conclusion
While the Thetanuts incident saw a high recovery rate due to white-hat intervention, the Aztec incident resulted in a total loss of the affected funds due to the protocol's immutable nature. These events highlight the persistent risk of legacy smart contracts that remain funded even after official support has ended.
Next Steps:
- Would you like a security audit summary of any other legacy DeFi protocols you currently hold assets in?
- I can monitor social sentiment and developer activity for Aztec or Thetanuts to see if further patches or migrations are announced.