According to BlockSec Phalcon analysis, the root cause of the Aztec incident is that the verified Rollup transaction set does not match the L1 settlement processing boundary (numRealTxs / _numTxs), leading to a mismatch between the ZK proof verification path and the L1 settlement logic's interpretation of the transaction list. Attackers can set numRealTxs to 1 and place a real deposit transaction in the second decoding transaction slot, thereby bypassing the corresponding L1 signature verification and pending deposit balance deduction, resulting in an unsupported private balance that can be withdrawn. BlockSec states that the attacker first records unsupported balances of seven different assets in the Rollup state, then withdraws the assets through seven transactions; additionally, RollupProcessorV3 was upgraded via PR #67 on April 10, 2024, but this upgrade appears to have been deployed without external audits beforehand.