Aztec Discloses Critical Soundness Flaw in Alpha V5 Proving System and Tells Teams to Halt Deployments

Aztec, the privacy-focused Ethereum layer-2 network, has disclosed a critical vulnerability in the proving system behind its Alpha V5 release. According to the disclosure, an attacker could construct a proof that passes verification for a transaction the network is supposed to reject, and an accepted transaction of that kind could move the chain into a state its own rules forbid.

Core contributors say they found the defect on 27 July 2026 through internal auditing assisted by artificial intelligence, and that the fix is scheduled for the next release, V6. The disclosure is unusually candid about what cannot be established: the affected system does not record enough information to separate ordinary accepted transactions from transactions accepted through the flawed proving path, so historical activity cannot confirm whether anyone exploited the bug or size the damage. Teams preparing V5 deployments are told to pause, and teams already live are told to review how they would limit user exposure, isolate the affected functionality, and migrate users to fresh contracts.

This is the second critical finding in Aztec's alpha cycle. In June the project told users of the previous version to withdraw funds ahead of the V5 upgrade after a flaw surfaced in Alpha V4. Aztec has also raised its bug bounty to $2 million, a sign of how much it is paying to find defects that conventional review misses.

The failure class matters beyond one network. A soundness bug in a proving system is not a contract bug that validators can catch by re-executing transactions. If the verifier accepts a false statement, every downstream assumption built on that proof inherits the error. L2Beat puts total value secured across Ethereum layer-2s at $51.10 billion, much of it dependent on proof systems whose correctness users cannot independently check.