zkLink Nova Bridge Exploit Drains $778,625 in ETH and Tokens in One Transaction
zkLink Nova suffered a bridge exploit on Ethereum on Oct. 28, with an attacker withdrawing assets worth approximately $778,625 in a single transaction. Blockchain security firm Blockaid said the attacker used a public relayer to introduce a forged batch root, enabling withdrawals to attacker-controlled addresses.
The transaction was executed at 6:21 p.m. ET and involved 22.43 ETH and 11 types of ERC-20 tokens transferred from Nova's Ethereum escrow and token bridge to the same recipient. The Defiant calculated the combined value using prices displayed by Etherscan at 10:25 p.m. ET.
pufETH Accounts for the Largest Share of the Exploit
The largest portion of the withdrawal consisted of 245.74 pufETH, valued at approximately $613,536 by Etherscan. The transaction also included around 18,113 USDC and 3,361 USDT, alongside ETH and other tokens.
The Defiant reported a combined transaction value of $778,625.84 based on the displayed prices of the transferred assets. That figure represents the value of the identified transaction, not a final estimate of the total losses associated with the incident.
Blockaid Identifies Forged Batch Root in Attack
According to Blockaid, the attacker exploited the bridge's authorization process by using a public relayer to submit a forged batch root, a cryptographic summary used to verify messages. The attacker then finalized withdrawals directed to addresses of their choosing.
zkLink Nova aggregates assets across Ethereum and its Layer 2 networks. Deposits are locked in smart contracts on their respective source chains and subsequently made available on Nova through its canonical bridge.
Under zkLink's documented settlement process, proof verification and cross-chain consistency checks are performed before a transaction batch is finalized. The batch root is then transmitted to connected chains to authorize withdrawals. Blockaid's account indicates that a forged root entered this process, allowing the attacker to proceed with the withdrawals.
Ethereum Transaction Logs Reveal Withdrawal Sequence
Logs from the Ethereum transaction show that a new batch root was recorded before the ETH and token withdrawal events occurred within the same transaction. Following the exploit, Etherscan displayed approximately 0.001 ETH remaining in the affected ETH escrow.
In an alert published at 10:24 p.m. ET on Oct. 28, Blockaid described the attack as “still ongoing.” A read-contract page for the main Ethereum escrow showed its pause flag set to false when checked at 10:29 p.m. ET. However, that reading alone does not establish whether other security controls had prevented additional withdrawals.
A response from zkLink was not immediately available at the time of the report. The available information does not establish the final losses or confirm whether further attacks were successfully prevented.
source: thedefiant
Writer: Ethan Collins
Crypto Journalist
Ethan Collins reports on developments across the cryptocurrency and blockchain sector. His work covers market movements, protocol updates, regulatory changes, and emerging trends in digital assets.
He focuses on presenting complex topics in a clear and accessible manner for a broad readership.
Check out other news and articles on Google News
Disclaimer:
The articles on Hokanews are here to keep you updated on the latest buzz in crypto, tech, and beyond—but they’re not financial advice. We’re sharing info, trends, and insights, not telling you to buy, sell, or invest. Always do your own homework before making any money moves.
Hokanews isn’t responsible for any losses, gains, or chaos that might happen if you act on what you read here. Investment decisions should come from your own research—and, ideally, guidance from a qualified financial advisor. Remember: crypto and tech move fast, info changes in a blink, and while we aim for accuracy, we can’t promise it’s 100% complete or up-to-date.