zkLink Nova Bridge Attack Drains About $786,000 in Assets

An ongoing attack on zkLink Nova’s Ethereum bridge has drained about $786,000 in Ether (ETH) and ERC-20 tokens, with withdrawals finalized through the network’s Layer 1 custody contract. The incident was still in progress on Oct. 29.

The attacker used a publicly available relayer to submit a forged batch root to Ethereum. After that root was injected, withdrawals from zkLink Nova’s L1 custody contract were finalized, allowing ETH and ERC-20 assets to be sent to a receiving address chosen by the attacker.

The reported loss combines funds taken from the L1 ETH custody system and the ERC-20 bridge. The $786,000 figure covers both ETH and token withdrawals through the affected infrastructure. The incident centers on zkLink Nova’s bridge, with Ethereum serving as the chain where the forged batch root was introduced. The attack remained active, and the $786,000 total reflects losses so far.