zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root
zkLink Nova bridge (Ethereum L1 escrow and ERC-20 bridge)
An attacker drained about $779K to $786K in ETH and 11 ERC-20 tokens (mostly pufETH) from zkLink Nova's Ethereum escrow and ERC-20 bridge in a single transaction on Oct 28 at 22:21 UTC. Blockaid says the attacker used a public relayer to inject a forged batch root and then finalized withdrawals to addresses they chose. SlowMist traces the root cause to the Arbitrator contract's claimMessage function, which did not clear a stored message hash or require a fresh authenticated callback, letting the publicly callable SyncL2TxHashRelayer make ZkLink.syncBatchRoot run as the legitimate Ethereum gateway. Blockaid called the attack ongoing and the main escrow still showed as unpaused hours later; zkLink had not commented.
Why this severity: About $786K drained from bridge custody contracts; Blockaid called the attack ongoing and the escrow was not paused
- Started
- Oct 28, 2026
Affected
- Assets held in zkLink Nova's Ethereum L1 escrow and L1 ERC-20 bridge
Fixed in
No fixed release yet
Timeline5
Blockaid flags an ongoing exploit: a public relayer was used to inject a forged batch root on Ethereum, about $786K drained so far.
SlowMist puts the loss at about $783.1K and says Arbitrator.claimMessage failed to clear the transient finalizeMessageHash or require a fresh authenticated callback, so the publicly callable SyncL2TxHashRelayer could make ZkLink.syncBatchRoot install an attacker-chosen root.
ExVul says the attacker installed a forged L2 logs root for batch 116409, then finalized 12 fake withdrawals with no matching L2 burn, through the allowlisted SyncL2TxHashRelayer.
Arisk traces an estimated ,100 loss: after swaps, about 702,200 DAI sat in three attacker wallets as of 03:40 UTC, while some funds went to FixedFloat and ChangeNOW. zkLink still had not commented.
At 22:21 UTC a single Ethereum transaction records a new batch root and then withdraws 22.43 ETH and 11 ERC-20 tokens (245.74 pufETH, about $613K, was the largest part) from zkLink Nova's escrow and token bridge to one address.
Advisories4
- ExVul alert: zkLink Nova forged L2 logs root for batch 116409ExVul · Oct 29, 2026
- Arisk fund tracing of the zkLink bridge exploitArisk · Oct 29, 2026
- Blockaid detected an ongoing exploit on the zkLink bridge on EthereumBlockaid · Oct 29, 2026
- SlowMist TI Alert: zkLink root cause analysisSlowMist · Oct 29, 2026
News & write-ups3
Posts1
🚨Blockaid detected an ongoing exploit on @zkLink_Official bridge on ethereum. Used a public relayer to inject a forged batch root on Ethereum, then finalized ETH and ERC20 withdrawals from zkLink Nova L1 escrow to attacker-chosen receivers. ~$786k drained from L1 ETH escrow and ERC20 bridge so far. Attack still ongoing.🧵
Get an email when a new major security incident drops. No spam, unsubscribe any time.
