Linea

Nova

Ethereum

zkLink

An attacker drained approximately $786,000 in cryptocurrency from zkLink Nova’s Ethereum bridge after exploiting its cross-chain verification process to authorize fraudulent withdrawals.
The attack, <a href="https://x.com/blockaid_/status/2115630787169050800" rel="noopener noreferrer nofollow">detected by blockchain security firm Blockaid</a>, involved submitting a forged batch root through a publicly accessible relayer. The malicious transaction enabled unauthorized withdrawals of Ether (ETH) and ERC-20 tokens from zkLink Nova’s Ethereum Layer 1 escrow contracts to addresses controlled by the attacker.
Blockaid identified the exploit late on October 28, 2026, and warned that the attack was still ongoing at the time of its disclosure. The full financial impact remains under investigation.
<h2 id="forged-batch-root-allows-unauthorized-bridge-withdrawals">Forged Batch Root Allows Unauthorized Bridge Withdrawals</h2>
The attacker targeted zkLink Nova’s settlement infrastructure, which coordinates asset transfers between Ethereum and connected Layer 2 networks.
Under zkLink’s <a href="https://docs.zklink.io/architecture/settlement-layer/in-detail-multi-chain-state-synchronization" rel="noopener noreferrer nofollow">cross-chain settlement architecture</a>, transaction batches are verified on Linea before their confirmed roots are relayed to secondary networks, including Ethereum, where they authorize withdrawals.
The attacker bypassed the expected verification process by injecting a fraudulent batch root through a public relayer. This allowed the Ethereum-side contracts to recognize unauthorized withdrawal requests as valid and release assets held in escrow.
The exploit affected the <a href="https://cryptoadventure.com/cross-chain-message-passing-what-actually-moves-when-a-bridge-says-it-bridged/" rel="noopener noreferrer nofollow">bridge’s message verification</a> and withdrawal authorization however the exact vulnerability that permitted the forged root to pass validation has not been established. Investigators have not disclosed evidence of compromised administrator keys or identified the attacker.
<h2 id="eth-and-erc-20-bridge-reserves-suffer-losses">ETH and ERC-20 Bridge Reserves Suffer Losses</h2>
The affected transactions removed assets from zkLink Nova’s Ethereum escrow and ERC-20 bridge contracts.
One identified Ethereum transaction <a href="https://x.com/blockaid_/status/2115630789647868103?a=RdaXtI_XTWTNl3vHVIM&amp;s=20" rel="noopener noreferrer nofollow">transferred</a> approximately 22.43 ETH alongside 11 ERC-20 assets to an attacker-controlled address. The largest withdrawal involved roughly 245.74 pufETH, valued at approximately $613,500 when the transaction was examined.
Additional transfers included approximately 18,113 USDC and 3,361 USDT, alongside smaller holdings of other tokens.
The transaction’s combined value was estimated at $779,000, representing most of Blockaid’s initial loss estimate rather than a separate incident.
The attack targeted reserves backing assets transferred through zkLink Nova, creating potential withdrawal and liquidity risks for users relying on those contracts.
Similar cross-chain verification failures have affected other protocols in 2026. In July, the <a href="https://cryptoadventure.com/verus-ethereum-bridge-drained-of-7-54m-in-second-exploit/" rel="noopener noreferrer nofollow">Verus Ethereum Bridge</a> lost $7.54 million after fraudulent import instructions triggered unauthorized withdrawals.
More recently, <a href="https://cryptoadventure.com/initia-halts-network-after-2-7-million-movevm-token-minting-exploit/" rel="noopener noreferrer nofollow">Initia’s bridge exploit</a> on October 23 resulted in approximately $2.7 million in losses after an attacker exploited a MoveVM vulnerability to create unbacked assets and redeem them against real cross-chain reserves.
<h2 id="zklink-bridge-recovery-and-security-response-remain-unconfirmed">zkLink Bridge Recovery and Security Response Remain Unconfirmed</h2>
zkLink has not publicly confirmed the complete scope of the exploit, whether the affected bridge contracts have been suspended or whether any stolen assets have been recovered.
No verified remediation plan, compensation arrangement or timetable for restoring secure withdrawals has been announced.
Users with assets on zkLink Nova face uncertainty over the availability of reserves backing withdrawals to <a href="https://cryptoadventure.com/the-beginners-guide-to-ethereum/" rel="noopener noreferrer nofollow">Ethereum</a>. Further bridge transactions carry additional risk until the affected infrastructure is secured and its operational status is confirmed.
Blockaid’s initial warning classified the attack as ongoing, while the latest publicly available information has not established that the vulnerability has been contained or that unauthorized withdrawals have stopped.
The post <a href="https://cryptoadventure.com/zklink-nova-bridge-drained-of-786k-after-forged-batch-root-exploit/" rel="noopener noreferrer nofollow">zkLink Nova Bridge Drained of $786K After Forged Batch Root Exploit</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

zkLink Nova Bridge Drained of $786K After Forged Batch Root Exploit

Table of Contents

Crypto Adventure

Other articles published on Oct 29, 2026

Join our free newsletter for daily crypto updates!