zkLink Nova

11 hours agoNews Editor

zkLink Nova Halts Block Production After Bridge Exploit Drains More Than $780,000

zkLink Nova, a network built by the zkLink team, stopped producing blocks after an attacker drained more than $780,000 from the bridge connecting Nova to Ethereum. In an update posted Thursday morning, zkLink said it had pushed emergency fixes to the affected contracts and temporarily disabled withdrawals while engineers review all related components. The team said services will return only after it confirms that all risks have been removed, but it did not provide a restart timeline, a confirmed loss figure, or a cause. Earlier, zkLink said the attack targeted Nova’s Arbitrator contract on both Ethereum and Optimism. It asked the attacker to stop and return the funds, offering a 20% white hat bounty and saying no further action would be taken if the assets were sent back. Onchain data reviewed by Unchained showed Nova’s escrow contract marked as paused on Ethereum by Thursday afternoon. Separate exploit transactions moved a mix of ETH and tokens, including pufETH, ezETH, and ZKL. Security firms Blockaid and SlowMist published differing but close loss estimates and described an attack path involving a forged batch root and reused message hash, though zkLink has not confirmed those accounts.

50

zkLink

1 days agoNews Editor

zkLink confirms ongoing attack on zkLink Nova, offers 20% white-hat bounty

zkLink said it has confirmed an ongoing attack targeting the Arbitrator contracts tied to zkLink Nova, its aggregated Layer 3 network, on Ethereum and Optimism. The team said it is working urgently to contain the situation and prevent additional losses, with further updates to be shared with the community later. The project also called on the party involved to stop exploiting zkLink Nova contracts across chains and return the affected funds. zkLink said it is prepared to offer a 20% white-hat bounty if the funds are returned, adding that it will not pursue the matter further after repayment. Security firm Blockaid had earlier said the attacker injected a forged batch root on Ethereum through a public relayer, then withdrew ETH and ERC-20 tokens from zkLink Nova’s L1 custody contract. At the time, Blockaid estimated combined losses from the L1 ETH custody and ERC-20 bridge at about $786,000, and said the attack was still ongoing.

60

zkLink

1 days agoNews Editor

zkLink says Nova contracts are under ongoing attack, offers 20% white-hat bounty

zkLink said it has confirmed an ongoing attack targeting the Arbitrator contracts tied to its aggregated Layer 3 network, zkLink Nova, on Ethereum and Optimism. The team said it is working urgently to contain the situation and prevent additional losses, and that it will provide further updates to the community. The project also called on the party involved to stop exploiting zkLink Nova contracts across chains and return the affected funds. zkLink said it is prepared to offer a 20% white-hat bounty if the funds are returned, adding that it will not pursue the matter after repayment. Security firm Blockaid had earlier said the attacker injected forged batch roots on Ethereum through a public relayer, then withdrew ETH and ERC-20 tokens from zkLink Nova’s L1 custody contract. At that time, combined losses from the L1 ETH custody and ERC-20 bridge were about $786,000, and the attack was still ongoing.

60

zkLink

1 days agoNews Editor

zkLink cross-chain bridge remains under attack with about $786,000 stolen

The zkLink cross-chain bridge on Ethereum is facing an ongoing attack, according to Odaily. The attacker reportedly used a public relayer to inject forged batch roots on Ethereum, then confirmed ETH and ERC20 withdrawals from zkLink Nova’s L1 custody contract. The stolen funds were then moved to an address designated by the attacker. So far, around $786,000 has been taken from the L1 ETH custody contract and the ERC20 bridge combined. Odaily said the attack was still in progress at the time of publication. The report did not disclose any additional technical details, mitigation steps, or the identities behind the receiving address.

70

Bit.Fan