Aztec Discloses Critical Proving-System Flaw in Its Live Alpha V5 Privacy Network

Aztec, the privacy-focused layer-2 network on Ethereum, told users that its live Alpha V5 release carries a critical vulnerability in the proving system. Contributors identified the defect on 27 July 2026 through internal auditing assisted by artificial intelligence (AI). The failure is a soundness break: an attacker may be able to construct a proof that passes verification for a transaction the protocol should have rejected. Funds, applications and contract state on V5 should be treated as exposed to a protocol-level failure until operators complete the required network actions, and the corrective release is planned for V6.

This is the second consecutive version of the network to ship with a proving-system flaw disclosed after launch. Aztec disclosed a critical vulnerability in Alpha V4 in March, urged users to withdraw before a governance vote made the details public, and delivered the patch in V5. The team frames these findings as the intended output of an alpha phase, in which the audit process is meant to surface exactly this class of defect before wider deployment.

The disclosure lands while Aztec pushes usage forward. The network has been promoting applications built on private execution, including a live version of the Dark Forest game and documentation on how gas works on Aztec, and it markets V5 as the current Alpha network release.

A soundness bug is a different risk category from a smart-contract exploit. Validator re-execution, the fallback most rollups rely on to catch bad state transitions, cannot detect a proof that verifies correctly against a flawed circuit. The user's real protections are conservative deposit limits, the escape hatch, and the team's willingness to disclose the flaw before an attacker finds it independently.