{
  "version": "https://jsonfeed.org/version/1.1",
  "title": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root · updates",
  "home_page_url": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026",
  "feed_url": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026/feed.json",
  "description": "An attacker drained about $779K to $786K in ETH and 11 ERC-20 tokens (mostly pufETH) from zkLink Nova's Ethereum escrow and ERC-20 bridge in a single transaction on Oct 28 at 22:21 UTC. Blockaid says the attacker used a public relayer to inject a forged batch root and then finalized withdrawals to addresses they chose. SlowMist traces the root cause to the Arbitrator contract's claimMessage function, which did not clear a stored message hash or require a fresh authenticated callback, letting the publicly callable SyncL2TxHashRelayer make ZkLink.syncBatchRoot run as the legitimate Ethereum gateway. Blockaid called the attack ongoing and the main escrow still showed as unpaused hours later; zkLink had not commented.",
  "language": "en",
  "_pwn": {
    "slug": "zklink-nova-bridge-forged-batch-root-exploit-oct-2026",
    "severity": "high",
    "status": "live",
    "patchStatus": "unpatched",
    "rss": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026/feed.xml",
    "llms": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026/llms.txt",
    "json": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026.json"
  },
  "items": [
    {
      "id": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-05fa8c9d",
      "url": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-05fa8c9d",
      "title": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: Blockaid flags an ongoing exploit: a public relayer was used to inject a forged batch root on Ethereum, about $786K drained so far.",
      "content_text": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: Blockaid flags an ongoing exploit: a public relayer was used to inject a forged batch root on Ethereum, about $786K drained so far.\n\nSource: https://x.com/blockaid_/status/2115630787169050800",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://x.com/blockaid_/status/2115630787169050800",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-03ee21d0",
      "url": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-03ee21d0",
      "title": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: SlowMist puts the loss at about $783.1K and says Arbitrator.claimMessage failed to clear the transient finalizeMessageHash or require a fresh authenticated callback, so the publicly callable SyncL2TxHashRelayer could make ZkLink.syncBatchRoot install an attacker-chosen root.",
      "content_text": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: SlowMist puts the loss at about $783.1K and says Arbitrator.claimMessage failed to clear the transient finalizeMessageHash or require a fresh authenticated callback, so the publicly callable SyncL2TxHashRelayer could make ZkLink.syncBatchRoot install an attacker-chosen root.\n\nSource: https://x.com/SlowMist_Team/status/2115635114638250409",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://x.com/SlowMist_Team/status/2115635114638250409",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-834104a5",
      "url": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-834104a5",
      "title": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: ExVul says the attacker installed a forged L2 logs root for batch 116409, then finalized 12 fake withdrawals with no matching L2 burn, through the allowlisted SyncL2TxHashRelayer.",
      "content_text": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: ExVul says the attacker installed a forged L2 logs root for batch 116409, then finalized 12 fake withdrawals with no matching L2 burn, through the allowlisted SyncL2TxHashRelayer.\n\nSource: https://x.com/exvulsec/status/2115677325752946703",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://x.com/exvulsec/status/2115677325752946703",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-69f57568",
      "url": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-29-69f57568",
      "title": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: Arisk traces an estimated ,100 loss: after swaps, about 702,200 DAI sat in three attacker wallets as of 03:40 UTC, while some funds went to FixedFloat and ChangeNOW. zkLink still had not commented.",
      "content_text": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: Arisk traces an estimated ,100 loss: after swaps, about 702,200 DAI sat in three attacker wallets as of 03:40 UTC, while some funds went to FixedFloat and ChangeNOW. zkLink still had not commented.\n\nSource: https://x.com/Arisk_io/status/2115693864220774522",
      "date_published": "2026-10-29T00:00:00.000Z",
      "external_url": "https://x.com/Arisk_io/status/2115693864220774522",
      "tags": [
        "high"
      ]
    },
    {
      "id": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-28-9508a8b4",
      "url": "https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026#2026-10-28-9508a8b4",
      "title": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: At 22:21 UTC a single Ethereum transaction records a new batch root and then withdraws 22.43 ETH and 11 ERC-20 tokens (245.74 pufETH, about $613K, was the largest part) from zkLink Nova's escrow and token bridge to one address.",
      "content_text": "zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root: At 22:21 UTC a single Ethereum transaction records a new batch root and then withdraws 22.43 ETH and 11 ERC-20 tokens (245.74 pufETH, about $613K, was the largest part) from zkLink Nova's escrow and token bridge to one address.\n\nSource: https://thedefiant.io/news/hacks/zklink-nova-bridge-exploit-drains-about-779-000-in-one-transaction",
      "date_published": "2026-10-28T00:00:00.000Z",
      "external_url": "https://thedefiant.io/news/hacks/zklink-nova-bridge-exploit-drains-about-779-000-in-one-transaction",
      "tags": [
        "high"
      ]
    }
  ]
}