Blockchain security firm Blockaid detected an ongoing exploit against zkLink Nova’s bridge on Ethereum on October 29, 2026. The attacker used a public relayer to inject a forged batch root on Ethereum, then finalized ETH and ERC-20 withdrawals from zkLink Nova's Layer 1 escrow to attacker-chosen receivers. Blockaid estimated roughly $786,000 had been drained at the time of disclosure, while noting the attack was still ongoing and the figure should be treated as a preliminary estimate.
The exploit centered on forged withdrawal verification. A batch root is a cryptographic commitment used to verify withdrawal data. By getting a forged root accepted on Ethereum, the attacker was able to make withdrawals appear valid to the bridge contracts and release escrowed assets. Both ETH and ERC-20 tokens were affected. The security firm said further investigation is needed to identify the underlying vulnerability, the full set of affected assets, and possible remediation measures.
zkLink later announced it had taken immediate action on zkLink Nova, halting block production and temporarily closing withdrawal channels after detecting the attack. The team said the attack targeted zkLink Nova Arbitrator contracts on Ethereum and Optimism. Immediate fixes were applied to the affected contracts, and all related components underwent a comprehensive security review. Services will not be reactivated until risks are eliminated, though no specific timeline was provided. The official update did not disclose a final damage total.
Until zkLink completes its review, users face paused block production and closed withdrawals, and the $786,000 figure remains a running estimate rather than a final accounting.
