zklink

🚨 zkLink Nova's Ethereum bridge reportedly lost around $786K — and the key issue wasn't token prices

According to Blockaid, an attacker used a public relayer to inject a forged batch root, then finalized unauthorized ETH and ERC-20 withdrawals from bridge reserves

$ETH

🔍 A batch root is supposed to authenticate transaction history before assets are released
If the bridge accepts a forged root, withdrawal proofs can appear valid against a history that never legitimately existed
That's the dangerous part
Real assets can leave escrow without a matching legitimate withdrawal on the other side


⚠️ Blockaid described the attack as ongoing in its initial alert, but containment and final losses remain unconfirmed

📌 If you rely on zkLink Nova's bridge, verify official security updates before making new transfers
This is a warning about cross-chain message verification — not proof that Ethereum or zero-knowledge cryptography itself was compromised $ETH


#zkLink #Ethereum

The zkLink cross-chain bridge has been suspended! The attacker can get a bounty by returning the funds!

The zkLink cross-chain bridge was just hacked! Services have been suspended, and withdrawals are disabled. But don't panic—the attacker can still get a 20% white-hat bounty by returning the funds! Around $786,000 in losses—those funds need to be recovered fast! #zkLink #跨链桥攻击 #WhiteHatBounty

zkLink cross-chain bridge suspends service, offers attacker a 20% bounty to return funds

The zkLink cross-chain bridge was attacked, prompting it to suspend service and disable withdrawals. zkLink offered the attacker a 20% white-hat bounty in exchange for returning the funds. Losses reached as much as $786,000. We’re always tracking the funds. #zkLink #跨链桥攻击 #FundTrackingTeam

zkLink officially confirms Nova cross-chain bridge is still under attack, offers 20% white-hat bounty and calls for funds to be returned

According to reports by Odaily and ME News cited by KuCoin, zkLink officially confirmed in a post on X on the evening of October 29 Beijing time that the Arbitrator contracts for zkLink Nova on Ethereum and Optimism are still under ongoing attack, and that its technical team is urgently working to contain the damage. The team called on the attacker to immediately stop exploiting all zkLink Nova contracts on-chain and return the funds. In exchange for cooperating and returning the funds, the attacker can receive a 20% bug bounty and will not be pursued.

Key points:
- The attack is ongoing: This is not a retelling of an old, one-off incident. The team confirmed tonight that the attack has not stopped, and that it affects the Arbitrator contracts on both Ethereum and Optimism.
- Losses are estimated at around $780,000: According to Blockaid’s monitoring, the attacker injected a forged batch root through a public relayer and withdrew ETH and ERC-20 assets from zkLink Nova’s Ethereum L1 custody contract. SlowMist estimates the losses at around $783,100, with the largest portion consisting of approximately 245.74 pufETH (about $615,000).
- The root cause has been disclosed: SlowMist’s analysis says the Arbitrator contract’s claimMessage function does not clear the temporary finalizeMessageHash, and does not require a new authentication callback for each call. The attacker exploited this to forge a batch root and complete withdrawals.
- Potential impact: A cross-chain bridge security incident directly undermines user trust in the bridge and related assets, creating short-term headwinds for ZKL. More importantly, the words “still ongoing” mean that interaction risks involving Nova-related contracts remain unresolved until the team announces that the attack has been contained.

My take: I’m bearish on $ZKL in the short term because the attack is still ongoing and the team has not announced that the vulnerability has been patched. Restoring trust will take time, so there’s reason for funds to stay away for now.

Sources: Posts on X by zkLink, cited by KuCoin, Odaily, and ME News; loss estimates and root-cause analysis based on monitoring and analysis by Blockaid and SlowMist.

#跨链桥安全 #zkLink #HackerAttack

Would a single bridge attack make you blacklist a project for good, or would you wait for a fix and audit before reconsidering? Share your thoughts in the comments, and tap the tag to see real-time market data. For informational purposes only; this is not investment advice.

【Market Update】zkLink Nova cross-chain bridge attacked; approximately $786,000 stolen
The attacker injected forged batch roots into Ethereum via a public relayer, withdrawing ETH and ERC-20 tokens from zkLink Nova’s Layer 1 custody contract. Blockaid reported that approximately $786,000 was stolen, and the attack is ongoing.
One transfer worth $778,625.84 included 22.43 ETH and 11 tokens. The largest single transfer was 245.74 pufETH, worth approximately $613,500. Only about 0.001 ETH remains in the custody contract, and the pause flag has not been set.
#币安广场 #zkLink
(Source: Cryptopolitan)

🚨 zkLink Nova hack: its bridge is breached, and the attacker is offered a 20% bounty.

zkLink Nova—a Layer 3 network designed to connect different blockchains and share liquidity between them, including $ETH Ethereum—confirmed a direct attack on its bridge contracts. Cybersecurity firm SlowMist estimates losses of around $783,100.
The attacker exploited a validation flaw in the contract to withdraw the funds. To prevent further damage, the team offered a 20% bounty as an ethical hacker (white hat) if the stolen money is returned, promising not to take legal action.

Do you think these bounties are enough to get the funds returned, or do they make protocols look bad?

#zkLink #SeguridadCripto

【Market Alert】A single transaction withdrew $779,000: The zkLink Nova bridge was reportedly found to have accepted forged batch roots, allowing an attacker to make an unauthorized withdrawal. The main custody contract was still not paused afterward.
The defenses weren’t breached—they were “fooled”: if batch roots can be forged, withdrawals become a mere formality.
The warning has been issued, but the pause button hasn’t been pressed. This window of inaction is the real exposure to risk.
Would you still dare to leave your assets in a cross-chain bridge long term?
$ZKL $ETH $BTC
#zkLink #跨链桥安全 #HackerAttack
(Source: The Defiant)
⚠️Risk Warning: The above is shared for informational purposes only and does not constitute investment advice. Investing involves risk; please exercise caution when entering the market.

zkLink Nova cross-chain bridge was hacked last night; a forged batch credential let about $780,000 slip through

At 22:21 UTC on October 28, a transaction withdrew about $780,000 from zkLink Nova’s Ethereum custody contract. That was 6:21 a.m. this morning Beijing time. Blockaid raised the first alarm, saying the attack was still underway and the main custody contract had not yet been paused. SlowMist’s analysis estimated the loss at about $783,100.

zkLink Nova is an aggregation-focused Layer 3 network that ultimately settles on Ethereum. When users withdraw from Nova to Ethereum, the custody contract first checks a credential called a batch root—the fingerprint of a batch of transactions. The contract releases the funds only if it recognizes the root. The problem was who could write that fingerprint into the contract.

SlowMist’s analysis points to the claimMessage function in the Arbitrator contract. It used finalizeMessageHash without clearing it afterward or requiring fresh authentication for every callback. The attacker first used a relay contract that anyone could call to load a valid hash, then changed the target to the Ethereum gateway, making the step that synced the batch root appear to come from the legitimate gateway. Once the impersonation succeeded, a fake root for batch 116409 was written into the contract. All the withdrawal proofs the attacker submitted checked out, and the custody contract released the funds. The entire operation happened in a single transaction, at block 26294188.

A total of 12 tokens were withdrawn. The largest haul was 245.74 pufETH from Puffer, worth about $615,000 and accounting for nearly 80% of the total. The rest included 22.43 ETH, 12.57 ezETH, 18,113 USDC, and small amounts of other tokens. In less than an hour, the attacker had swapped 123.26 ETH on Curve, then transferred about 303 ETH to three addresses in three transactions. Another attacker address later withdrew about 216.4 million ZKL, worth around $42,000, from the same bridge.

The lesson for retail investors isn’t about the amount. $780,000 isn’t much compared with the $292 million Kelp DAO incident in April this year. What really matters is the attack path. A publicly callable relay contract was treated as an authorized party, and a temporary value that wasn’t properly cleared broke the verification chain midway through. If the vault mistakes who’s at the door, it won’t matter how much is inside. At the time of writing, zkLink had not issued a public statement, confirmed whether the bridge was paused, or announced a compensation plan. Rushing to withdraw now could mean sending funds through a door that hasn’t been closed yet.

My view is straightforward. When a bridge is compromised, first check its official accounts for a pause announcement. Don’t rush to withdraw. If there’s no announcement that the bridge has been paused, don’t make new deposits or interact with it for now. If you already have assets in it, withdrawing in batches is safer than pulling everything out at once. Check the pause announcement before withdrawing.

Do you currently have assets locked in any cross-chain bridges? When did you last check their pause status and official announcements?

#BTC #跨链桥 #安全复盘 #zkLink #DeFi Security

—— web3 Chives Xiao Kai
This content is compiled from public information and does not constitute investment advice. The amounts mentioned are based on public records from Blockaid, SlowMist, and Etherscan. For subsequent updates, refer to the project’s official channels.