Aztec Discloses a Critical Flaw in the Proving System Securing Its Live Privacy Network

Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system of its Alpha V5 release. Core contributors identified the flaw on 27 July 2026 through internal auditing assisted by machine analysis. The description is specific and severe: an attacker may be able to construct a proof that passes verification for a transaction the network should reject, producing a state transition outside the rules the protocol intends to enforce. Contributors told users to treat funds, applications, and contract state on V5 as exposed to a protocol-level failure until incident response completes and node operators carry out the required network actions.

The finding comes days after Alpha V5 launched on mainnet on 21 July, a release that cut fees below five cents and proved a private transaction in about 2.5 seconds on a consumer laptop. It is also the second proving-system failure in the same lineage. Aztec disclosed a critical vulnerability in Alpha V4 earlier this year and, according to The Defiant, told V4 users to withdraw before 25 June, when a governance vote would make the V4 flaw public.

A soundness bug in a zero-knowledge proving system is a different risk class from a smart-contract bug. Most rollups rely on validators re-executing transactions to catch an invalid state root. On a network where execution is private by construction, that mechanism does not exist, because no one outside the transaction can re-run it. The proof is the only verification that distinguishes a valid ledger from a forged one.

Aztec has continued releasing new features in parallel, including an on-chain game now running on the network and published documentation on its fee mechanism. That combination, a live network with real applications alongside an acknowledged proof-verification defect, illustrates the pattern the privacy sector is likely to repeat as it moves from testnets to production.