ZeroTrace vault: forged ZK proof emptied backing (~4.67 ETH); same verifier class as Payy
12 Oct 2026: privacy-token project ZeroTrace says its vault paid out its full backing after accepting a forged zero-knowledge proof. 67 ETH (~$12K).
ZeroTrace blames a soundness flaw in a verifier generated with an outdated Aztec Barretenberg build; Aztec fixed the flaw on 14 May 2026, but ZeroTrace says the official installer still mapped its Noir version to a build without the fix.
It says the same flaw was used against Payy on 24 Sep. ZeroTrace promises to restore every balance in ZERO within 24–48 hours in a new vault with a patched verifier.
Project self-report only; no firm alert, and Aztec has not responded publicly in our pass. A different account (@ZeroTraceZK) is a separate project. Research snapshot from ZeroTrace's X post-mortem.
369 take
Dollar size is tiny; the class is not. A known, fixed proving-library bug can still reach new deployments through the default install path.
Teams using Noir or Barretenberg verifiers should pin and verify their build. This is ZeroTrace's account of events, not an Aztec finding.
Sources