# Aztec Says an Attacker Could Forge Valid Proofs on Its Privacy Network, Puts V5 Funds at Risk

Core contributors found the soundness defect through internal artificial-intelligence-assisted auditing on 27 July 2026 and will only fix it in the next release, V6.

- Published: 2026-09-21T05:47:19.973Z
- Canonical: https://polylog.news/crypto/2026-09-21/aztec-says-an-attacker-could-forge-valid-proofs-on-its-priva
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Aztec Network (disclosure)](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), [Aztec Network (Alpha V5)](https://aztec.network/alpha-v5), [Aztec Network (Dark Forest launch)](https://aztec.network/blog/dark-forest-aztec-game-goes-live)

Aztec, the Ethereum layer-2 network built for private smart contracts, has disclosed a critical vulnerability in the proving system that secures its [Alpha V5 release](https://aztec.network/blog/alpha-v5-proving-system-vulnerability). According to the project's own account, an attacker may be able to construct a proof that passes verification for a transaction the network is supposed to reject. If the network accepts such a proof, the resulting state transition falls outside the rules the protocol is meant to enforce.

The practical consequence is direct. Aztec told users to treat funds, applications and contract state on V5 as exposed to a protocol-level failure until contributors finish incident response and network operators carry out the required actions. Contributors also said they cannot determine whether anyone exploited the flaw before they found it.

Core contributors identified the defect on 27 July 2026 through internal auditing assisted by artificial intelligence, after internal and external human audits had already been completed. Reviewers say they have found no other high-severity or critical issues in V5 so far. The fix is scheduled for V6, including circuit updates that stop the network from accepting proofs tied to the affected proving system. Aztec has been shipping applications on the network in parallel, including a [live on-chain game built on private state](https://aztec.network/blog/dark-forest-aztec-game-goes-live).

This is the failure mode that separates zero-knowledge rollups from ordinary smart-contract risk. A buggy contract loses only the money inside that contract. A proving system that accepts an invalid proof breaks the guarantee the whole chain rests on, and the fallback most optimistic rollups rely on, namely validators re-executing transactions, does not exist here. The defect sits in mathematics and circuit construction, not in application logic, so an auditor reading Solidity code would never see it.

The disclosure also carries a second, uncomfortable message for the privacy sector. Aztec is the most technically ambitious attempt to put confidential execution on Ethereum, and its own tooling, not an outside attacker and not a bug-bounty hunter, found the problem. That outcome shows the internal review process working as intended. It is also evidence that proof soundness remains an unsolved engineering problem at the moment institutions are being told confidential execution is ready for them.

## What this means

Users with assets on Aztec V5 bear the direct exposure, because a forged proof could move value out of contracts without any key compromise, and there is no re-execution fallback to catch it. The broader cost lands on every zero-knowledge rollup competing for institutional deposits: due-diligence teams now have a named example of a proving-system defect that survived both internal and external human audits, which raises the evidentiary bar for any chain marketing privacy as production-ready and slows the migration of regulated capital onto private execution layers.

## What to watch

- Whether V6 ships with the circuit changes Aztec describes, and whether any independent team verifies the fix publicly. A quiet upgrade with no external confirmation would show that disclosure standards here are still set by the teams themselves.
- Whether value stays on or leaves Aztec V5 while the flaw is unpatched. A large outflow would show users treat a soundness warning as seriously as an active exploit, which is what would force other zero-knowledge teams to pre-commit to escape hatches.
- Whether rival privacy projects such as Miden or Zcash-aligned teams publish their own proving-system audit results in response. Competitive disclosure would be the fastest route to a shared standard for how soundness bugs get reported.