An attacker drained approximately $786,000 in cryptocurrency from zkLink Nova's Ethereum bridge by exploiting its cross-chain verification process to authorize fraudulent withdrawals.

Blockchain security firm Blockaid identified the exploit late on October 28, 2026, disclosing the incident in posts on X (post, post) and warning that the attack was still ongoing at the time of its disclosure. The full financial impact remains under investigation.

Forged Batch Root Enabled Unauthorized Withdrawals

The attacker targeted zkLink Nova's settlement infrastructure, which coordinates asset transfers between Ethereum and connected Layer 2 networks. The attack involved submitting a forged batch root through a publicly accessible relayer, enabling unauthorized withdrawals of Ether (ETH) and ERC-20 tokens from zkLink Nova's Ethereum Layer 1 escrow contracts to addresses controlled by the attacker.

Under zkLink's cross-chain settlement architecture, transaction batches are verified on Linea before their confirmed roots are relayed to secondary networks, including Ethereum, where they authorize withdrawals. Each confirmed root serves as a cryptographic commitment to a batch of transactions, and the Ethereum-side contracts rely on that relayed commitment when authorizing withdrawals, making its integrity central to the bridge's security model.

By injecting the fraudulent batch root through the public relayer, the attacker bypassed the expected verification process. This allowed the Ethereum-side contracts to recognize unauthorized withdrawal requests as valid and release assets held in escrow.

The exploit affected the bridge's message verification and withdrawal authorization; however, the exact vulnerability that permitted the forged root to pass validation has not been established. Investigators have not disclosed evidence of compromised administrator keys or identified the attacker.

ETH and ERC-20 Bridge Reserves Suffer Losses

The affected transactions removed assets from zkLink Nova's Ethereum escrow and ERC-20 bridge contracts. One identified Ethereum transaction transferred approximately 22.43 ETH alongside 11 ERC-20 assets to an attacker-controlled address. The largest withdrawal involved roughly 245.74 pufETH, valued at approximately $613,500 when the transaction was examined.

Additional transfers included approximately 18,113 USDC and 3,361 USDT, both dollar-pegged stablecoins, alongside smaller holdings of other tokens. The transaction's combined value was estimated at $779,000, representing most of Blockaid's initial loss estimate rather than a separate incident.

Because the attack targeted the reserves backing assets transferred through zkLink Nova, it creates potential withdrawal and liquidity risks for users relying on those contracts. Bridges concentrate those reserves in Layer 1 escrow contracts so the same assets can circulate across multiple networks — a structure that has made escrowed bridge funds a recurring target when cross-chain message verification fails.

Similar cross-chain verification failures have affected other protocols in 2026. In July, the Verus Ethereum Bridge lost $7.54 million after fraudulent import instructions triggered unauthorized withdrawals. More recently, Initia's bridge exploit on October 23 resulted in approximately $2.7 million in losses after an attacker exploited a MoveVM vulnerability to create unbacked assets and redeem them against real cross-chain reserves.

Recovery and Security Response Remain Unconfirmed

zkLink has not publicly confirmed the complete scope of the exploit, whether the affected bridge contracts have been suspended, or whether any stolen assets have been recovered. No verified remediation plan, compensation arrangement, or timetable for restoring secure withdrawals has been announced.

Users with assets on zkLink Nova face uncertainty over the availability of the reserves backing withdrawals to Ethereum. Further bridge transactions carry additional risk until the affected infrastructure is secured and its operational status is confirmed.

Blockaid's initial warning classified the attack as ongoing, and the latest publicly available information has not established that the vulnerability has been contained or that unauthorized withdrawals have stopped. The developments that would clarify the final impact are official confirmation of the affected contracts' operational status, updated loss figures as on-chain tracing continues, and any disclosure of how the forged root passed validation.