On October 28, a hacker breached the zkLink Nova bridge that connects the zkLink network to Ethereum and Optimism, extracting more than $780,000 in assets. The exploit targeted the protocol’s Arbitrator contract, allowing the attacker to forge batch roots and withdraw tokens and ETH to multiple wallets. In response, the zkLink team stopped block production, paused the bridge’s escrow contract and disabled withdrawals while engineers audit the compromised components.

ETH / USD
Quelle: CoinGecko. Kurse sind Richtwerte.

How the exploit unfolded

According to Unchained, the first malicious transaction was confirmed at 6:21 p.m. ET on October 28 and pulled roughly 245.7 pufETH (valued at over $600,000) along with a handful of other tokens from the bridge. A second transaction, flagged by security firm SlowMist three hours later, moved 33 additional token types, most notably about 216.4 million ZKL tokens worth roughly $50,000. A third, smaller withdrawal occurred early Thursday morning, repeating the initial pattern. Blockaid traced the root cause to a function in the Arbitrator contract that permitted reuse of a valid message hash, enabling the attacker to inject a forged batch root and approve withdrawals to addresses of its choosing.

The zkLink team announced the breach on X, acknowledging the attack on the Arbitrator contract and urging the perpetrator to return the stolen funds. They offered a 20% bounty for a white‑hat return, stating that no further legal action would be taken if the assets were recovered. Engineers have rushed out patches to the affected contracts and are conducting a comprehensive review before restoring services. No timeline has been provided for when the network will resume normal operation.

Broader context and what to watch next

The incident follows a recent spate of bridge exploits, including a flash‑loan attack on an Avalanche‑based vault that stole about $1 million and the offline status of Initia’s chain after a $2.7 million bridge drain. Analysts note that the reuse‑hash vulnerability highlighted by Blockaid and SlowMist underscores persistent risks in cross‑chain messaging contracts. Observers will monitor whether any of the stolen assets are moved on-chain, the effectiveness of zkLink’s patches, and any potential regulatory scrutiny of bridge security practices.