zkLink Nova Halts Network After Attacker Drains $780,000 From Bridge

The zkLink team halted block production on its zkLink Nova network and suspended withdrawals following a bridge exploit that siphoned more than $780,000 on Oct. 28 ¹. The incident targeted Nova's Arbitrator contract across both Ethereum and Optimism, prompting the protocol developers to deploy contract patches and temporarily shut down the cross-chain bridge while conducting an infrastructure review ¹.

Onchain data showed an initial unauthorized transfer confirmed at 6:21 p.m. ET on Oct. 28, which extracted approximately 245.7 pufETH—valued at more than $600,000—alongside 22.43 $ETH and other assets from bridge and escrow contracts ¹. A second transaction detected roughly three hours later removed additional assets, including about 216.4 million $ZKL tokens valued at around $50,000, followed by a third smaller withdrawal early on Oct. 29 ¹. Blockaid calculated total losses at approximately $786,000, while SlowMist estimated the stolen sum at $783,100 ¹.

Bridge Vulnerability and Recovery Offer

According to security firm Blockaid, the attacker manipulated a public relayer to submit a fabricated batch root on Ethereum, enabling unauthorized approval of asset withdrawals ¹. SlowMist reported that a flaw in the Arbitrator contract allowed the reuse of an existing message hash to establish a manipulated batch root and validate forged proofs ¹. The zkLink development team has not officially verified either firm's technical breakdown ¹.

In a public notice, zkLink offered the perpetrator a 20% white hat bounty in exchange for returning the stolen assets, pledging to forgo further legal action if the funds are recovered ¹. The team stated that zkLink Nova operations will remain offline until engineers confirm all security risks have been resolved, providing no specific timeline for a restart ¹. At the time of writing, $ETH traded at $2,248, down 4.6% over the preceding 24 hours.