zkLink Nova Bridge Drained of $786K After Forged Batch Root Exploit

An attacker drained approximately $786,000 in cryptocurrency from zkLink Nova's Ethereum bridge after exploiting its cross-chain verification process to authorize fraudulent withdrawals. The attack, detected by blockchain security firm Blockaid, involved submitting a forged batch root through a publicly accessible relayer. The malicious transaction enabled unauthorized withdrawals of Ether (ETH) and ERC-20 tokens from zkLink Nova's Ethereum Layer 1 escrow contracts to addresses controlled by the attacker. Blockaid identified the exploit late on October 28, 2026, and warned that the attack was still ongoing at the time of its disclosure. The full financial impact remains under investigation.