zkLink Nova, a crypto network built by the zkLink team, has stopped producing blocks after an attacker pulled more than $780,000 from the bridge linking Nova to Ethereum on Wednesday evening, according to Unchained.
In a Thursday morning update, zkLink said it had rushed out fixes for the affected contracts and temporarily turned off withdrawals while engineers review every related component. The team wrote on X that zkLink Nova services will return only after it has fully confirmed that all risks have been eliminated. It did not give a timeline, a loss figure, or an explanation for the incident.
About four hours earlier, zkLink acknowledged the attack and said it targeted Nova’s Arbitrator contract on both Ethereum and Optimism. In that X post, the team asked the party behind the exploit to stop and return the funds. It also offered a 20% white hat bounty, adding: 「No further action will be pursued if funds are returned.」
Onchain activity shows the escrow contract marked as paused
As of 3:50 p.m. ET on Thursday, Nova’s escrow contract showed a paused status, based on Unchained’s reading of Ethereum data. The data did not indicate when that pause began.
By Thursday afternoon, the wallet behind the first exploit transaction had already moved almost everything it took. It no longer held any pufETH, USDC, USDT, or WBTC, and it had less than 0.001 ETH left. About 2.5 mswETH and 2.6 mstETH remained in the wallet.
The first transaction was confirmed at 6:21 p.m. ET on Oct. 28 and pulled funds from two contracts at the same time. Restaked ether accounted for most of the value. About 245.7 pufETH, worth more than $600,000 at Thursday prices, left the token bridge along with 10 other tokens, including about 12.6 ezETH. Nova’s escrow contract also released about 22.43 ETH.
Security firm SlowMist flagged a second transaction sent roughly three hours later, at 9:43 p.m. ET. In that transfer, another wallet pulled 33 more token types from the bridge, most of them in small amounts. The largest share of value came from about 216.4 million ZKL, zkLink’s native token, worth roughly $50,000 at Thursday prices. Unchained said it confirmed that transaction onchain, and the wallet still held about 1.24 ETH and most of the tokens it had taken.
A third withdrawal went through at 6:06 a.m. ET on Thursday from a different wallet. That transfer was for about 0.0025 ETH and repeated the same steps used in the first transaction. Unchained said it checked only the Ethereum side and did not review Optimism.
Blockaid and SlowMist described the exploit path
Blockaid raised the alarm at 10:24 p.m. ET on Wednesday. The firm said the attacker used a public relayer to inject a forged batch root on Ethereum, which allowed it to authorize ETH and token withdrawals and route the assets to addresses of its choosing. While the drain was still underway, Blockaid estimated that about $786,000 had been taken.
SlowMist put the figure at about $783,100. The firm said the issue traced back to a function in the Arbitrator contract that allowed the attacker to reuse an already valid message hash, install a batch root of its choice, and withdraw funds with forged proofs.
zkLink has not confirmed either firm’s account.
Incident follows other recent security breaches
The drain came one day after Blockaid flagged a flash-loan attack that took about $1 million from an Avalanche-based tranche vault.
Earlier this month, Initia’s chain went offline with no restart date after an attacker minted tokens and, by co-founder Zon’s estimate, bridged out about $2.7 million. In a separate Blockaid report, the firm said hackers still hold $287 million in stolen crypto that cannot be frozen.
