# Aztec Discloses a Critical Proof Flaw in Its V5 Alpha as Miden Pitches Private Stablecoin Finance

Aztec contributors found a flaw that could let a forged proof pass verification, discovered it on July 27 with AI-assisted auditing, and will not ship the fix until the V6 upgrade later this year.

- Published: 2026-10-15T05:43:12.254Z
- Canonical: https://polylog.news/crypto/2026-10-15/aztec-discloses-a-critical-proof-flaw-in-its-v5-alpha-as-mid
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Aztec Network](https://aztec.network/blog/alpha-v5-proving-system-vulnerability), [Aztec Network](https://aztec.network/alpha-v5), [Miden](https://miden.xyz/prifi-stack), [Miden](https://miden.xyz/blog/bread-is-privacy-baked-in), [The Defiant](https://thedefiant.io/news/defi/aztec-v4-withdraw-june-25-v5-upgrade-security-vulnerability), [The Block](https://www.theblock.co/post/409065/aztec-upgrades-v5-alpha-adding-private-execution-environment-decentralized-ethereum-l2), [Unchained](https://unchainedcrypto.com/aztec-revives-its-private-payments-wallet-capping-every-transfer-below-2500/)

Aztec, the privacy-focused Ethereum layer-2 network, has [disclosed a critical vulnerability](https://aztec.network/blog/alpha-v5-proving-system-vulnerability) in the proving system of its [V5 Alpha](https://aztec.network/alpha-v5). According to the team, an attacker may be able to build a proof that passes verification for a transaction the network should reject. If the network accepted such a proof, the result would be a state change outside the rules V5 is meant to enforce. Core contributors found the flaw on July 27 through internal AI-assisted auditing. The fix is planned for V6, which will include circuit updates that stop the network from accepting proofs tied to the affected proving system. Aztec says reviewers have found no other high-severity or critical issues in V5.

This is the second critical disclosure during Aztec's alpha phase. In June, the team [told V4 users to withdraw](https://thedefiant.io/news/defi/aztec-v4-withdraw-june-25-v5-upgrade-security-vulnerability) before June 25, as the V5 upgrade exposed security flaws. V5 added a [full private execution environment](https://www.theblock.co/post/409065/aztec-upgrades-v5-alpha-adding-private-execution-environment-decentralized-ethereum-l2). Aztec has also limited its exposure directly: its revived private payments wallet [caps every transfer below $2,500](https://unchainedcrypto.com/aztec-revives-its-private-payments-wallet-capping-every-transfer-below-2500/).

This class of bug matters more on a privacy chain than elsewhere. On a transparent rollup, validators can re-execute transactions as a backstop. On Aztec, private execution happens on the user's own device, and the network sees only the proof, so validators have nothing to re-execute. A soundness flaw in that setting defeats the main check the system has.

Miden, the privacy network spun out of Polygon, is making the commercial case for confidential execution at the same time. Its [PriFi stack](https://miden.xyz/prifi-stack) pairs stablecoins with privacy infrastructure aimed at payroll, treasury, supplier payments and lending. Miden argues that public ledgers expose activity that no business would want to run in the open. The company has also launched [Bread](https://miden.xyz/blog/bread-is-privacy-baked-in), a self-custodial private wallet for sending, receiving and swapping. Earning and cross-chain features are listed as coming soon.

## What this means

Privacy layer-2 networks are asking institutions to trust a proof that no one else can independently re-check. Aztec's disclosure shows that the proof itself can be the failure point. The parties exposed are depositors on alpha-stage privacy networks and the institutions Miden and Aztec are courting. A soundness bug creates a hidden-inflation or theft risk that outside observers cannot audit after the fact. Aztec found this bug itself and disclosed it on a schedule tied to its next upgrade, which matches a pattern the desk has tracked elsewhere, and the transfer caps limited the possible damage. Zcash is the clearest precedent: it quietly fixed a counterfeiting flaw in its original Sprout proving system in 2018 and disclosed it in early 2019. Its response afterward was to add independent supply checks rather than abandon privacy. Many treat privacy layer-2 networks as ready for institutional payments. The desk's read is that institutions will first require supply-integrity checks, transfer caps, and more than one independent proof system. The likelier outcome over the next three to six months is that institutional privacy pilots stay capped and permissioned while V6 and similar upgrades ship. A clean audit of Aztec's V6 circuits followed by higher caps would prove that read wrong. A second soundness disclosure in V6 would push institutional demand toward privacy run by known operators, such as permissioned pools.

## What to watch

- The V6 release date and whether Aztec publishes an independent audit of the new circuits. A delay would mean the alpha caps stay in place longer.
- Whether Aztec raises or removes the $2,500 transfer cap after V6. Raising it would show the team believes the soundness risk is under control.
- Which named firms adopt Miden's PriFi stack and Circle-issued private stablecoins. Real customers would separate institutional demand from marketing.