Aztec 2.0 rollup exploit follow-up (2026-06-17): three onward wallets that moved the attacker's ETH, incl. a 10 ETH Tornado Cash deposit
- Scam type: Hack
- Chain: EVM (Ethereum, BNB Chain, Base and other EVM chains)
- Project or site name: Aztec
- Incident date: 2026-06-17
- Reported: 2026-10-24
- Last updated: 2026-10-24
Follow-up to our report on the 2026-06-17 exploit of the deprecated Aztec 2.0 rollup contract (https://blockint.ai/c3?report=456a1937-0ccd-420c-998d-d71720ecb99e). That report listed the two holding wallets named by Aztec Labs and gave three onward wallets in its text only. On-chain data shows all three moving the stolen ETH, so this report lists them. Addresses (Ethereum): - 0x9ed8e94a2d296bf0be71eb3424dc67347acce4f8 (funded by holding wallet B; sent 10 ETH into Tornado Cash) - 0x5999578de622165e8438589916829874bba61ae2 (received about 802.13 ETH from attacker EOA 0x6952d9…e97f and passed…
Other addresses in this report: 0x5999578de622165e8438589916829874bba61ae2, 0x69923e5264b6e1634ee673f34fc6350cb7a05f72
Linked reports: Aztec 2.0 rollup exploit (2026-06-17) follow-up: two attacker holding wallets and a copycat wallet named by Aztec Labs