In June 2026, a deprecated smart contract used by Aztec Connect was drained of roughly $2.1–$2.3 million. The contract, RollupProcessorV3, was still live and callable at its address even after the team had moved on. The incident is a stark reminder that on Ethereum, deprecation notices and shut-down front ends don't kill the code.
The drain and what it wasn't
The attack was a settlement-boundary bypass on the deprecated pathway, not a new cryptographic break. The contract remained live and callable at its address, so attackers could interact with it directly via transactions. The funds were pulled from a system that was supposed to be retired but never actually stopped working.
Why zombie contracts persist
Ethereum contracts are immutable by default. Only explicit upgrade designs allow behavior changes. When a team deprecates a product or shuts down a website, the bytecode stays on-chain. The address remains callable, and if an upgrade path or admin authority is removed or renounced, there's no way to pause, patch, or retire the legacy contract.
That's the trap. Public deprecation notices don't disable the contract itself. Integrators that still point to a legacy address can unknowingly route users to deprecated logic. The risk doesn't come from the code being old; it comes from live entry points, residual value, and broken assumptions about admins or off-chain actors.
Who's exposed
End users with residual balances are the most obvious victims. But integrators, protocol teams and DAOs, and auditors and monitors all carry exposure. If a contract is still callable, anyone can trigger it. The Aztec Connect drain shows that even a deprecated pathway can hold enough value to be worth attacking.
Prevention starts with lifecycle planning
Zombie contracts are best prevented with lifecycle planning. That means thinking about retirement before deployment — how the contract will be disabled, who has the authority, and what happens to residual funds. Without that, deprecation is just a label, not a kill switch.
The Aztec Connect incident is a concrete example of what happens when a contract outlives its maintenance. The bytecode remains at its address, and anyone can call it. Until teams build retirement into their designs, the risk doesn't go away.
