---
title: "zkLink Nova Halts Network After Attacker Drains $780,000 From Bridge"
description: "The team paused block production and disabled withdrawals after an exploit targeted its Arbitrator contract on Ethereum and Optimism."
url: https://basisdesk.news/news/zklink-nova-halts-after-bridge-exploit
published: 2026-10-30T00:11:19.999Z
modified: 2026-10-30T00:11:19.999Z
section: Security & Hacks
author: Basis Desk Newsroom (AI-generated, source-verified)
sentiment: bearish
tickers: [ETH, ZKL]
tags: [zklink-nova, bridge-exploit, ethereum, optimism, smart-contracts]
license: Quote with attribution to Basis Desk (basisdesk.news). Not financial advice.
---

# zkLink Nova Halts Network After Attacker Drains $780,000 From Bridge

The team paused block production and disabled withdrawals after an exploit targeted its Arbitrator contract on Ethereum and Optimism.

## At a glance

- **What happened:** zkLink halted Nova block production and paused withdrawals after an attacker drained more than $780,000 via its cross-chain bridge contracts on Oct. 28.
- **Why it matters:** The breach highlights ongoing contract vulnerabilities in bridging architecture and leaves Nova bridge services unavailable indefinitely.
- **Who is affected:** zkLink Nova network participants, asset depositors, and bridge users on Ethereum and Optimism.
- **What's next:** zkLink engineers are reviewing contracts and will restore services once security risks are verified eliminated.
- **Primary source:** [zkLink Nova Goes Offline After Hacker Steals More Than $780,000 From Its Bridge](https://unchainedcrypto.com/zklink-nova-goes-offline-after-hacker-steals-more-than-780000-from-its-bridge/) — unchainedcrypto.com

## Key points

- zkLink paused Nova block production and disabled withdrawals after an attacker siphoned over $780,000 from its cross-chain bridge on Oct. 28 [1].
- Security firms traced the issue to Nova's Arbitrator contract on Ethereum and Optimism, which allowed unauthorized batch root submissions [1].
- The zkLink team deployed contract patches, offered a 20% bounty for the return of funds, and gave no fixed timeline for restoring services [1].

## Editorial remark

- **Context:** Cross-chain bridges remain persistent vectors for protocol exploits, with attackers continuing to target smart contract verification functions and relayer mechanisms.
- **Impact:** Users of zkLink Nova cannot bridge or withdraw assets while the network remains halted and contracts stay paused during security reviews.
- **Watch:** Confirmation from zkLink regarding the restart date for Nova services and whether the attacker accepts the 20% white-hat bounty offer.

The zkLink team halted block production on its zkLink Nova network and suspended withdrawals following a bridge exploit that siphoned more than $780,000 on Oct. 28 [1]. The incident targeted Nova's Arbitrator contract across both Ethereum and Optimism, prompting the protocol developers to deploy contract patches and temporarily shut down the cross-chain bridge while conducting an infrastructure review [1].

Onchain data showed an initial unauthorized transfer confirmed at 6:21 p.m. ET on Oct. 28, which extracted approximately 245.7 pufETH—valued at more than $600,000—alongside 22.43 $ETH and other assets from bridge and escrow contracts [1]. A second transaction detected roughly three hours later removed additional assets, including about 216.4 million $ZKL tokens valued at around $50,000, followed by a third smaller withdrawal early on Oct. 29 [1]. Blockaid calculated total losses at approximately $786,000, while SlowMist estimated the stolen sum at $783,100 [1].

## Bridge Vulnerability and Recovery Offer

According to security firm Blockaid, the attacker manipulated a public relayer to submit a fabricated batch root on Ethereum, enabling unauthorized approval of asset withdrawals [1]. SlowMist reported that a flaw in the Arbitrator contract allowed the reuse of an existing message hash to establish a manipulated batch root and validate forged proofs [1]. The zkLink development team has not officially verified either firm's technical breakdown [1].

In a public notice, zkLink offered the perpetrator a 20% white hat bounty in exchange for returning the stolen assets, pledging to forgo further legal action if the funds are recovered [1]. The team stated that zkLink Nova operations will remain offline until engineers confirm all security risks have been resolved, providing no specific timeline for a restart [1]. At the time of writing, $ETH traded at $2,248, down 4.6% over the preceding 24 hours.

## Sources

1. [zkLink Nova Goes Offline After Hacker Steals More Than $780,000 From Its Bridge](https://unchainedcrypto.com/zklink-nova-goes-offline-after-hacker-steals-more-than-780000-from-its-bridge/) — unchainedcrypto.com, 2026-10-30

---
Basis Desk Newsroom · AI-generated, source-verified · https://basisdesk.news/about/how-we-use-ai