Aztec’s zk.money privacy wallet is live again, and it launched on a known critical flaw
Aztec Labs relaunched its zk.money privacy wallet on the Aztec Network on September 29, and the company has disclosed that a critical flaw in the network’s V5 proof system remains unfixed at launch. Aztec confirmed the relaunch in a post on X, and CEO Joe Andrews said zk.money would go live before the flaw is repaired.
Contributors disclosed the V5 proving-system flaw in August 2026, with a fix planned for the next version. Until then, a separate system called Oxide checks payments for errors caused by software bugs. Aztec’s own disclosure of the V5 vulnerability sits in the same week of documentation that warns the software has not been fully audited and that critical bugs are possible.
The wallet hides payment amounts, balances and recipients inside zk.money, but the entry point is only partly private. Aztec’s bridging documentation states that a deposit from Ethereum reveals the sender and the amount even though the recipient on the network can stay private.
Other safeguards stand in for the missing fix. Every deposit, payment and withdrawal must stay below $2,500, and all users share a single $50,000 daily deposit allowance. A sealed server co-signs operations but cannot spend user funds on its own, and deposit and withdrawal addresses on the Ethereum side are screened against a sanctions policy. Aztec says the wallet is non-custodial and that it cannot spend, move or freeze funds.
Andrews said limits will be raised “as confidence grows and after a later version goes live.” Until that later version ships, the caps stay where they are.
zk.money returned three years after the original was wound down in March 2023, and the relaunch follows private smart contract execution going live on the network on September 21. The original wallet drew more than 75,000 wallets and over $100 million in volume before the shutdown.
