Aztec v5 private transactions are now live on Ethereum mainnet after token holders voted to activate the upgrade on-chain, making this a governance-ratified protocol change rather than a unilateral team push. The alpha release, confirmed by the Aztec Network official blog, ships the fastest private proving the network has produced, cutting both proving time and transaction costs in half compared with V4.
Client-Side ZK Execution: What Actually Changed in V5
The core architecture routes private computation to user devices. Rather than broadcasting transaction inputs across every node, the execution engine generates recursive SNARKs locally using Noir, Aztec’s domain-specific language for private contracts. The network verifies those proofs without ever seeing plaintext values, account identities, or execution state.
The hybrid state model addresses the contention problem that has plagued privacy-focused L2s. Private assets live in UTXO-like note trees; public data in key-value trees. Private functions can defer public function calls within the same transaction lifecycle, so confidential operations and shared DeFi state can interact without race conditions or non-deterministic execution.
According to The Defiant, the security surface was stress-tested before launch: 234+ researchers participated in a Cantina bug bounty programme. V5 also patches critical vulnerabilities carried over from V4, including flaws that could have enabled fund theft, and activates economic penalties alongside enhanced re-execution committee protections, per the KuCoin blog.
The transaction privacy model has a direct bearing on MEV exposure. Because transaction details stay hidden until state commitment, reordering pending transactions for extractable value becomes structurally harder. The architecture also supports confidential order matching, private liquidity provisioning, and selective compliance via viewing keys.
ZKPassport Acquisition Extends Aztec v5 Private Transactions Into Identity
Aztec Labs completed the acquisition of Obsidion Labs Ltd., the British startup behind ZKPassport, in May 2026. Co-founders Michael Elliot and Theo Madzou joined Aztec Labs along with the rest of the team, per the Aztec Labs acquisition announcement. The deal was framed around a specific data point: 780 data compromises exposed the personal data of nearly 140 million people in Q1 2026 alone.
ZKPassport proofs can be verified server-side for non-blockchain use cases or on-chain across Aztec, Ethereum, or any EVM-compatible chain, according to SiliconANGLE. Aztec Labs committed to keeping both the protocol and the iOS app open source.
The technology had already been deployed on Aztec’s network to reduce Sybil attacks and was used during the AZTEC token sale to run sanctions screening without exposing participant data. Aztec Labs CEO Zac Williamson described the selective-disclosure model in April 2025: users tap an NFC-enabled passport, generate a zero-knowledge proof, and choose ‘what information you want to disclose,’ whether that is nationality, age, or other identity attributes. He called the approach ‘permissionless, it’s privacy preserving, and it ensures strong compliance,’ adding that such systems are ‘a lot more powerful’ than existing privacy solutions.
Williamson’s broader thesis is that privacy is not a niche vertical: ‘all crypto will be private’ as programmable privacy becomes standard infrastructure, he argued, calling user privacy, confidential transaction data, and private smart contract execution ‘the holy grail of blockchain privacy.’
Legacy Contract Exploits Shadowed the Release
The V5 launch arrived alongside disclosures about two separate exploits on long-deprecated Aztec contracts. One involved a payments product launched in 2021 and discontinued in 2022, from which roughly $2 million was drained from an immutable contract that the team could neither pause nor upgrade.
The Aztec Connect exploit is the larger incident. The first attack executed at 12:26 UTC on 14 June, with Aztec Labs identifying it internally four minutes later. According to The Defiant, citing BlockSec’s analysis, the attacker withdrew 908.99 ETH (worth approximately $1.6 million), 270,513 DAI, and 167.89 wrapped staked ETH (approximately $357,000), along with smaller positions in yvDAI, yvWETH, LUSD, and yvLUSD.
The snippet cited approximately $2.1 million for the Aztec Connect total; Rekt News reports the figure was $2.28 million across two separate attackers exploiting the same flaw on two consecutive mornings. Aztec Labs had deprecated the product in March 2023 and handed back admin keys in April 2024, leaving the contracts immutable and unmonitored. The Aztec Foundation stated the exploits have no connection to the live network or the AZTEC ERC-20 token.
The binary question for V5 is whether the halved proving times move private DeFi from a developer curiosity to something with retention: watch TVL accumulation in the first 30 days as the clearest signal.
