zkLink Nova Halts Network After Attacker Drains $780,000 From Bridge

AI disclosure: drafted by Basis Desk's AI newsroom and machine-checked against the primary sources listed below — how we use AI. Originally published on Basis Desk.

The team paused block production and disabled withdrawals after an exploit targeted its Arbitrator contract on Ethereum and Optimism.

Key points

• zkLink paused Nova block production and disabled withdrawals after an attacker siphoned over $780,000 from its cross-chain bridge on Oct. 28 [1].
• Security firms traced the issue to Nova's Arbitrator contract on Ethereum and Optimism, which allowed unauthorized batch root submissions [1].
• The zkLink team deployed contract patches, offered a 20% bounty for the return of funds, and gave no fixed timeline for restoring services [1].

The zkLink team halted block production on its zkLink Nova network and suspended withdrawals following a bridge exploit that siphoned more than $780,000 on Oct. 28 [1]. The incident targeted Nova's Arbitrator contract across both Ethereum and Optimism, prompting the protocol developers to deploy contract patches and temporarily shut down the cross-chain bridge while conducting an infrastructure review [1].

Onchain data showed an initial unauthorized transfer confirmed at 6:21 p.m. ET on Oct. 28, which extracted approximately 245.7 pufETH—valued at more than $600,000—alongside 22.43 $ETH and other assets from bridge and escrow contracts [1]. A second transaction detected roughly three hours later removed additional assets, including about 216.4 million $ZKL tokens valued at around $50,000, followed by a third smaller withdrawal early on Oct. 29 [1]. Blockaid calculated total losses at approximately $786,000, while SlowMist estimated the stolen sum at $783,100 [1].

Bridge Vulnerability and Recovery Offer

According to security firm Blockaid, the attacker manipulated a public relayer to submit a fabricated batch root on Ethereum, enabling unauthorized approval of asset withdrawals [1]. SlowMist reported that a flaw in the Arbitrator contract allowed the reuse of an existing message hash to establish a manipulated batch root and validate forged proofs [1]. The zkLink development team has not officially verified either firm's technical breakdown [1].

In a public notice, zkLink offered the perpetrator a 20% white hat bounty in exchange for returning the stolen assets, pledging to forgo further legal action if the funds are recovered [1]. The team stated that zkLink Nova operations will remain offline until engineers confirm all security risks have been resolved, providing no specific timeline for a restart [1]. At the time of writing, $ETH traded at $2,248, down 4.6% over the preceding 24 hours.

Sources

1. zkLink Nova Goes Offline After Hacker Steals More Than $780,000 From Its Bridge — Primary document (discovered)

---

Basis Desk is a source-verified crypto newsroom. Market data, a free MCP server for AI agents and JSON APIs: basisdesk.news/developers. Not investment advice.