# zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root · pwn.watch

> An attacker drained about $779K to $786K in ETH and 11 ERC-20 tokens (mostly pufETH) from zkLink Nova's Ethereum escrow and ERC-20 bridge in a single transaction on Oct 28 at 22:21 UTC. Blockaid says the attacker used a public relayer to inject a forged batch root and then finalized withdrawals to addresses they chose. SlowMist traces the root cause to the Arbitrator contract's claimMessage function, which did not clear a stored message hash or require a fresh authenticated callback, letting the publicly callable SyncL2TxHashRelayer make ZkLink.syncBatchRoot run as the legitimate Ethereum gateway. Blockaid called the attack ongoing and the main escrow still showed as unpaused hours later; zkLink had not commented.

Page: https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026 · generated 2026-10-29T08:16:58.615Z

## Status
- Severity: high · status: live · patch: unpatched
- Product: zkLink Nova bridge (Ethereum L1 escrow and ERC-20 bridge)
- Started: 2026-10-28
- Affected: Assets held in zkLink Nova's Ethereum L1 escrow and L1 ERC-20 bridge

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026/feed.xml
- JSON Feed: https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026.json
- This file: https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026/llms.txt

## Updates (newest first)
- 2026-10-29: Blockaid flags an ongoing exploit: a public relayer was used to inject a forged batch root on Ethereum, about $786K drained so far. (https://x.com/blockaid_/status/2115630787169050800)
- 2026-10-29: SlowMist puts the loss at about $783.1K and says Arbitrator.claimMessage failed to clear the transient finalizeMessageHash or require a fresh authenticated callback, so the publicly callable SyncL2TxHashRelayer could make ZkLink.syncBatchRoot install an attacker-chosen root. (https://x.com/SlowMist_Team/status/2115635114638250409)
- 2026-10-29: ExVul says the attacker installed a forged L2 logs root for batch 116409, then finalized 12 fake withdrawals with no matching L2 burn, through the allowlisted SyncL2TxHashRelayer. (https://x.com/exvulsec/status/2115677325752946703)
- 2026-10-29: Arisk traces an estimated ,100 loss: after swaps, about 702,200 DAI sat in three attacker wallets as of 03:40 UTC, while some funds went to FixedFloat and ChangeNOW. zkLink still had not commented. (https://x.com/Arisk_io/status/2115693864220774522)
- 2026-10-28: At 22:21 UTC a single Ethereum transaction records a new batch root and then withdraws 22.43 ETH and 11 ERC-20 tokens (245.74 pufETH, about $613K, was the largest part) from zkLink Nova's escrow and token bridge to one address. (https://thedefiant.io/news/hacks/zklink-nova-bridge-exploit-drains-about-779-000-in-one-transaction)

## Fix brief
# Security brief: zkLink Nova's Ethereum bridge drained of about $786K through a forged batch root

Source: https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026 · status: live · severity: high · updated Oct 29, 2026, 07:10 UTC

## Patch status
**UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.**

## What it is
An attacker drained about $779K to $786K in ETH and 11 ERC-20 tokens (mostly pufETH) from zkLink Nova's Ethereum escrow and ERC-20 bridge in a single transaction on Oct 28 at 22:21 UTC. Blockaid says the attacker used a public relayer to inject a forged batch root and then finalized withdrawals to addresses they chose. SlowMist traces the root cause to the Arbitrator contract's claimMessage function, which did not clear a stored message hash or require a fresh authenticated callback, letting the publicly callable SyncL2TxHashRelayer make ZkLink.syncBatchRoot run as the legitimate Ethereum gateway. Blockaid called the attack ongoing and the main escrow still showed as unpaused hours later; zkLink had not commented.

Severity detail: About $786K drained from bridge custody contracts; Blockaid called the attack ongoing and the escrow was not paused

- Product: zkLink Nova bridge (Ethereum L1 escrow and ERC-20 bridge)

## Affected versions
- Assets held in zkLink Nova's Ethereum L1 escrow and L1 ERC-20 bridge

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Mitigations
The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows).

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Specific notes
There is nothing to patch. Until zkLink confirms the bridge is paused and fixed, avoid bridging assets into or out of zkLink Nova, and treat any 'refund' or 'claim' link that isn't from zkLink's official channels as a scam.

## Latest updates
- Oct 29, 2026: Blockaid flags an ongoing exploit: a public relayer was used to inject a forged batch root on Ethereum, about $786K drained so far.
- Oct 29, 2026: SlowMist puts the loss at about $783.1K and says Arbitrator.claimMessage failed to clear the transient finalizeMessageHash or require a fresh authenticated callback, so the publicly callable SyncL2TxHashRelayer could make ZkLink.syncBatchRoot install an attacker-chosen root.
- Oct 29, 2026: ExVul says the attacker installed a forged L2 logs root for batch 116409, then finalized 12 fake withdrawals with no matching L2 burn, through the allowlisted SyncL2TxHashRelayer.
- Oct 29, 2026: Arisk traces an estimated ,100 loss: after swaps, about 702,200 DAI sat in three attacker wallets as of 03:40 UTC, while some funds went to FixedFloat and ChangeNOW. zkLink still had not commented.
- Oct 28, 2026: At 22:21 UTC a single Ethereum transaction records a new batch root and then withdraws 22.43 ETH and 11 ERC-20 tokens (245.74 pufETH, about $613K, was the largest part) from zkLink Nova's escrow and token bridge to one address.

## Advisories
- [ExVul alert: zkLink Nova forged L2 logs root for batch 116409](https://x.com/exvulsec/status/2115677325752946703) (ExVul)
- [Arisk fund tracing of the zkLink bridge exploit](https://x.com/Arisk_io/status/2115693864220774522) (Arisk)
- [Blockaid detected an ongoing exploit on the zkLink bridge on Ethereum](https://x.com/blockaid_/status/2115630787169050800) (Blockaid)
- [SlowMist TI Alert: zkLink root cause analysis](https://x.com/SlowMist_Team/status/2115635114638250409) (SlowMist)

## Write-ups & news
- [zkLink Nova Bridge Exploit Drains About $779,000 in One Transaction](https://thedefiant.io/news/hacks/zklink-nova-bridge-exploit-drains-about-779-000-in-one-transaction)
- [zkLink Nova Bridge Exploited for ~$786K as Forged Batch Root Drains Ethereum Escrow](https://www.cryptotimes.io/2026/10/29/zklink-nova-bridge-exploited-for-786k-as-forged-batch-root-drains-ethereum-escrow/)
- [zkLink Nova Bridge Attack Drains About $786,000 in Assets](https://www.tokenpost.com/news/technology/43193)

---
Machine-readable: https://pwn.watch/i/zklink-nova-bridge-forged-batch-root-exploit-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.