Aztec Says a Soundness Flaw in Its Proving System Puts Funds on Its Live Privacy Network at Risk

Aztec, the privacy-focused layer-2 network built on Ethereum, disclosed a critical vulnerability in the proving system behind its Alpha V5 release. According to the disclosure, an attacker may be able to construct a proof that passes verification for a transaction the network should reject, producing a state change outside the rules the protocol is meant to enforce. Contributors identified the flaw on 27 July using internal review assisted by artificial intelligence, and they say they cannot determine whether anyone exploited it before the finding.

This is a soundness defect, not a smart-contract bug, and that distinction decides who can catch it. On a transparent chain, validators re-execute transactions and can detect an invalid state change. On a privacy network, where transaction contents are hidden and the proof is the only evidence the rules were followed, re-execution offers no fallback. Aztec told users to treat funds and applications on Alpha V5 as exposed to a protocol-level failure until incident response finishes and network operators carry out required actions. Alpha V5 went live on Ethereum mainnet in July with private transaction proving that Aztec says runs more than twice as fast as its predecessor, and applications have been deploying on it since.

It is the second critical proving-system flaw Aztec has disclosed this year. A comparable defect in Alpha V4 surfaced in March, and users were told to withdraw before 25 June ahead of the V5 upgrade. Aztec says internal and external human audits are now complete, that reviewers have not identified other high-severity or critical Alpha V5 issues at this time, and that a security roadmap covering the remaining work will follow.

The pattern matters more than any single bug. Zero-knowledge (ZK) proving stacks are large, new, and understood in depth by a small number of engineers, and the "Alpha" label Aztec applies is an explicit statement that the network is in the period for finding faults before production. Users who bridged real value into the network carried production risk on pre-production software all the same.