zkLink Nova Bridge Attack Drains About $786,000 in Assets

An ongoing attack on zkLink Nova’s Ethereum bridge has drained about $786,000 in Ether (ETH) and ERC-20 tokens, with withdrawals finalized through the network’s Layer 1 custody contract. The incident was still in progress on Oct. 29. The attacker used a publicly available relayer to submit a forged batch root to Ethereum. After that root was injected, withdrawals from zkLink Nova’s L1 custody contract were finalized, allowing ETH and ERC-20 assets to be sent to a receiving address chosen by the attacker. The reported loss combines funds taken from the L1 ETH custody system and the ERC-20 bridge.