SlowMist Says ZKLink Attack Drained About $783,000 Through Unauthorized Withdrawals

SlowMist attributed an estimated $783,000 loss at cross-chain protocol ZKLink to an attack that exploited transient storage and enabled unauthorized withdrawals.

Its analysis described the attacker using the flaw to forge a batch root, then using that forged root to withdraw assets without authorization. The transactions involved one Ether (ETH) and 11 ERC-20 transfers. The reported loss was about $783,000.

SlowMist recommended that cross-chain relay projects reset transient storage and bind verification values. The recommendation named two safeguards: resetting the storage and binding the values used for verification.

ZKLink is a cross-chain protocol, and the suggested changes were directed at related cross-chain relay projects.