zkLink Nova Bridge Drained of About $780,000 in Forged Batch Root Exploit
A single transaction built on a forged batch root pulled ETH and tokens from the bridge escrow on October 29, according to on-chain analysts and crypto media.
Key Takeaways
- Hackers drained roughly $780,000 from the zkLink Nova bridge on October 29 in one transaction.
- The attacker used a forged batch root that bypassed proof validation, on-chain analysts say.
- Reports put the loss at $779,000 to $786,000, about 22.43 ETH plus ERC-20 tokens.
- zkLink has not published a statement on the exploit at the time of writing.
Hackers drained roughly $780,000 from the zkLink (ZKL) Nova bridge on October 29 in a single transaction built on a forged batch root.
How the Exploit Worked
On-chain analysts traced the attack to a forged batch root injected through a public relayer. The crafted root bypassed validation in the Arbitrator contract on Ethereum, and the legitimate zkLink Gateway contract then processed it. That let the attacker finalise withdrawals from the bridge escrow without a valid proof behind them.
The loss is put at $779,000 to $786,000 across roughly 22.43 ETH and several ERC-20 tokens, and the escrow was left nearly empty. Security trackers flagged the transaction as it happened, and one report noted the main escrow contract was not paused during the drain.
What Nova Is
Nova is zkLink's aggregated Layer 3 zkEVM network, designed to let Ethereum-compatible apps deploy on a shared liquidity layer. The bridge moves assets between Nova and Ethereum, holding user deposits in an escrow contract on the Ethereum side. A batch root is the summary commitment that proves a set of withdrawals is valid, and the Arbitrator contract is where that proof is checked. Forging one is a direct strike at the bridge's trust model, the same class of flaw that has hit cross-chain bridges before.
What Happens Next
At the time of writing zkLink has not published a statement about the exploit or about recovery of the funds. The Defiant reported the single-transaction drain as it unfolded, and Crypto Times put the final loss at $786,000. Exploits of this type usually trigger a standard incident response: pausing contracts, tracing funds and contacting exchanges. The transaction record stays public on Ethereum and the attacker's addresses have circulated among security researchers. The ZKLink price chart on Coinranking tracks the token as the project responds.
Frequently Asked Questions
How Much Was Drained from the zkLink Nova Bridge?
Reports put the loss at $779,000 to $786,000, roughly 22.43 ETH plus ERC-20 tokens, taken in a single transaction on October 29.
How Did the Exploit Work?
The attacker injected a forged batch root through a public relayer. It bypassed proof validation and let unbacked withdrawals finalise from the Ethereum bridge escrow.
Has zkLink Responded?
zkLink had not published a statement on the exploit at the time of writing.
Sources
- zkLink Nova Bridge Exploit Drains About $779,000 in One Transaction · The Defiant
- zkLink Nova Bridge Exploited for $786K as Forged Batch Root Drains Ethereum Escrow · Crypto Times
- Incident tracker post on the zkLink Nova bridge exploit · PwnWatch
Prices and market data: Coinranking.
