An attacker drained approximately $786,000 in cryptocurrency from zkLink Nova’s Ethereum bridge after exploiting its cross-chain verification process to authorize fraudulent withdrawals. The
An attacker drained approximately $786,000 in cryptocurrency from zkLink Nova’s Ethereum bridge after exploiting its cross-chain verification process to authorize fraudulent withdrawals.
The attack, detected by blockchain security firm Blockaid, involved submitting a forged batch root through a publicly accessible relayer. The malicious transaction enabled unauthorized withdrawals of Ether (ETH) and ERC-20 tokens from zkLink Nova’s Ethereum Layer 1 escrow contracts to addresses controlled by the attacker.
Blockaid identified the exploit late on October 28, 2026, and warned that the attack was still ongoing at the time of its disclosure. The full financial impact remains under investigation.
The attacker targeted zkLink Nova’s settlement infrastructure, which coordinates asset transfers between Ethereum and connected Layer 2 networks.
Under zkLink’s cross-chain settlement architecture, transaction batches are verified on Linea before their confirmed roots are relayed to secondary networks, including Ethereum, where they authorize withdrawals.
The attacker bypassed the expected verification process by injecting a fraudulent batch root through a public relayer. This allowed the Ethereum-side contracts to recognize unauthorized withdrawal requests as valid and release assets held in escrow.
The exploit affected the bridge’s message verification and withdrawal authorization however the exact vulnerability that permitted the forged root to pass validation has not been established. Investigators have not disclosed evidence of compromised administrator keys or identified the attacker.
The affected transactions removed assets from zkLink Nova’s Ethereum escrow and ERC-20 bridge contracts.
One identified Ethereum transaction transferred approximately 22.43 ETH alongside 11 ERC-20 assets to an attacker-controlled address. The largest withdrawal involved roughly 245.74 pufETH, valued at approximately $613,500 when the transaction was examined.
Additional transfers included approximately 18,113 USDC and 3,361 USDT, alongside smaller holdings of other tokens.
The transaction’s combined value was estimated at $779,000, representing most of Blockaid’s initial loss estimate rather than a separate incident.
The attack targeted reserves backing assets transferred through zkLink Nova, creating potential withdrawal and liquidity risks for users relying on those contracts.
Similar cross-chain verification failures have affected other protocols in 2026. In July, the Verus Ethereum Bridge lost $7.54 million after fraudulent import instructions triggered unauthorized withdrawals.
More recently, Initia’s bridge exploit on October 23 resulted in approximately $2.7 million in losses after an attacker exploited a MoveVM vulnerability to create unbacked assets and redeem them against real cross-chain reserves.
zkLink has not publicly confirmed the complete scope of the exploit, whether the affected bridge contracts have been suspended or whether any stolen assets have been recovered.
No verified remediation plan, compensation arrangement or timetable for restoring secure withdrawals has been announced.
Users with assets on zkLink Nova face uncertainty over the availability of reserves backing withdrawals to Ethereum. Further bridge transactions carry additional risk until the affected infrastructure is secured and its operational status is confirmed.
Blockaid’s initial warning classified the attack as ongoing, while the latest publicly available information has not established that the vulnerability has been contained or that unauthorized withdrawals have stopped.
The post zkLink Nova Bridge Drained of $786K After Forged Batch Root Exploit appeared first on Crypto Adventure.
