On Sept 24, someone stole $1.92M from a protocol by forging a zero-knowledge proof. Here's how Payy Network's bridge got drained. Payy is a privacy-focused stablecoin network built as a ZK rollup on Ethereum. USDC deposits sit in a bridge contract on L1. On Payy, balances are private notes, and transactions publish only note commitments. A withdrawal to Ethereum is a "burn." The circuit enforces that input value equals output value plus the withdrawal amount. Payy's node verifies each transaction proof, aggregation circuits re-verify them recursively, and the final proof is posted to the bridge via verifyRollup. The contract pays out the burns. No layer can see note values, so none can redo the balance check. Every layer trusts the proof below it. That only holds if the verifier is sound: it must never accept a proof of a false statement. The attacker submitted a 1,828,589 USDC burn backed by four empty padding notes. No value behind it. Payy's circuit rejects that transaction when run directly. But the forged proof passed the verifier, the aggregation layer re-checked it with the same verifier, and the bridge paid out. Two more forged burns followed, bringing the total to $1.92M across three fraudulent withdrawals and two Ethereum settlements. Payy's postmortem points to a soundness bug in Barretenberg, Aztec's proving backend for Noir, in its small-subgroup IPA check. The prover commits to a running sum that should start at zero and end at the claimed total. The "starts at zero" constraint was merged with the first-step constraint into one equation. The flaw allowed a malicious prover to offset the starting value, cancel the error in the first step, and manipulate the claimed total. Payy's postmortem identifies this as the likely cause, although the exact method used to forge the attacker's proof remains unconfirmed. Aztec committed the fix on May 14 and released it on July 13. Payy was still running an October 2025 build when the attack happened, 73 days after the patched version was released. Remember your attack surface includes code you didn't write, and it keeps changing after your audit is done. An audit examines a system at a point in time. It doesn't automatically protect you when vulnerabilities are discovered in dependencies months later. Continuous security means someone is always looking: at your contracts, your dependencies, and the gap between them. And getting paid to tell you.