← The Polylog Crypto Intelligence Brief
Morning Edition · Monday, August 10, 2026Published at 1:51 AM EDT · New York
Aztec Discloses a Second Critical Proving-System Flaw, This Time in Its Live Alpha V5 Privacy Network
Core contributors say an internal audit assisted by artificial intelligence found that an attacker could build a proof the verifier accepts for a transaction the network should reject.
Aztec, the Ethereum layer-2 network built for private smart contracts, has told users that its current release carries a protocol-level failure in the component that decides what is true. Contributors identified the flaw on 27 July 2026 through internal auditing assisted by artificial intelligence, and describe it as allowing an attacker to construct a proof that passes verification for a transaction the network should reject. Funds, applications and contract state on V5 should be treated as exposed until incident response finishes.
The distinction matters. This is a soundness failure, not a privacy leak. On a zero-knowledge rollup, the proof is the only thing standing between a valid state transition and an invented one. Aztec has said of this class of bug that it cannot be caught by having validators publicly re-execute transactions, because there is no public execution to re-run. Confidentiality is exactly what removes that backup check.
This is the second such disclosure in five months. Aztec found a critical proving-system vulnerability in Alpha V4 in March, withheld the details, and urged users to withdraw before 25 June so that the patch and the disclosure could ship together in V5. V5 was the fix. V5 now has its own. The team has been consistent that Alpha is experimental and that users should not deposit more than they are willing to lose, and the network is still pre-mainnet, so the money at risk is small relative to the general-purpose rollups. The reputational risk is significant.
Two readings compete, and the next few weeks decide between them. Either the AI-assisted audit pipeline is working as intended and is clearing a backlog of latent proving bugs faster than attackers can find them, in which case disclosure frequency rises now and falls later. Or the proving stack for private execution is simply not mature enough for value at scale, in which case each release cycle produces another critical finding and mainnet slips again. The evidence that separates them is whether the next disclosure comes from a defender or from a drained contract.
Veracity: Corroborated
80/100- If true, who benefits
Part of a tracked trend
Unaudited Open-Source Crypto Code Surfaces at Scale
Coordinated volunteer and AI-assisted review keeps exposing large backlogs of undiscovered defects in the open-source libraries that wallets, nodes and protocols depend on, so disclosure waves — not novel attacker research — become a recurring driver of emergency patches and incident risk across the ecosystem.
Townsquare
Start a discussion in Townsquare.
More from this edition
- A Build Flag Checked the Wrong Way Left Five Years of Coldcard Seeds Guessable, and Thieves Found It First
- Bitcoin's BIP-110 Fork Mined Two Blocks and Then Stopped
- Rekt's Half-Year Review Puts DeFi Losses at $939.86 Million and Locates the Failures in Signers, Not Contract Code
- Ostium Lost $23.75 Million Through a Price Forwarder It Had Placed Outside Its Own Bug Bounty Scope
- NYSE Says It Is Advancing On-Chain Settlement for Tokenized Securities
- The Senate Left the CLARITY Act Off Its Schedule While Brussels Reopens MiCA
- Hyperliquid's Revenue Has Fallen for Four Straight Quarters While Its Open Interest Rose
Comments
1Aug 11, 2:19 AM · edited
On a private inputs ZK chain, a successful exploit of this flaw leaves no public record of the fabricated inputs, so loss accounting and attribution after the fact are structurally harder than on a transparent rollup.