Verify a decision

{"actor":"system:backfill","investigation_id":"02ace50a-5179-4b3a-850a-0cf5a2fdbb3d","kind":"publish","page_slug":"zklink-nova","published_at":"2026-11-04T12:24:25.702Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"zkLink Nova","sections":[{"content":"On approximately October 28-29, 2026, an attacker drained zkLink Nova's Ethereum Layer 1 custody/escrow contract. Multiple blockchain security and news outlets reported that the attacker exploited a publicly callable relayer function (reported by some outlets as a 'SyncL2TxHashRelayer'-type function) to inject a forged Layer 2 batch root into the bridge's verification contracts, which allowed withdrawals that the bridge had never actually approved. Blockaid reported the attack as still ongoing at the time of its initial disclosure. Loss estimates vary by source: Blockaid and others cited approximately $786,000, SlowMist estimated about $783,100, and other outlets cited figures ranging from roughly $779,000 to $797,000, generally described as about 22.43 ETH plus eleven ERC-20 tokens. The Ethereum-side escrow was reportedly drained to near zero (approximately 0.001 ETH remaining) during the incident. Reports differ on the exact date, with some outlets citing October 28 and others October 29, 2026, so the day-level timing is not fully settled across sources.","heading":"October 2026 Bridge Exploit","severity":"critical","sources":[{"credibility":2,"name":"zkLink Nova Bridge Suffers $786K Forged Root Exploit","type":"news_article","url":"https://coinalertnews.com/news/2026/10/29/zklink-nova-bridge-786k-exploit"},{"credibility":2,"name":"zkLink Nova escrow drained via fake batch root","type":"news_article","url":"https://en.coinotag.com/zklink-nova-escrow-drained-fake-batch-root"},{"credibility":2,"name":"zkLink Nova Bridge Drained of 786K After Forged Batch Root Exploit","type":"news_article","url":"https://coinranking.com/news/zklink-nova-bridge-drained-about-780000-forged-batch-root"},{"credibility":2,"name":"ChainCatcher: zkLink cross-chain bridge coverage","type":"news_article","url":"https://www.chaincatcher.com/en/article/2300365"},{"credibility":1,"name":"Unchained Crypto coverage of zkLink Nova bridge attack","type":"news_article","url":"https://unchainedcrypto.com/?p=50344"},{"credibility":2,"name":"Phemex: zkLink cross-chain bridge under active attack","type":"news_article","url":"https://phemex.com/news/article/zklink-crosschain-bridge-under-active-attack-786k-stolen-via-forged-batch-root-injection-101680"},{"credibility":2,"name":"DefiLlama Hacks Tracker","type":"research","url":"https://defillama.com/hacks?id=5129"}]},{"content":"Security firm SlowMist reportedly attributed the exploit's root cause to a function in zkLink Nova's Arbitrator smart contract that allowed reuse of an already-valid message hash, which allegedly let the attacker install an attacker-chosen batch root and finalize withdrawals the bridge had never approved. This root-cause account comes from secondary reporting citing SlowMist's analysis; at the time of the most recent available reporting, zkLink had not issued a public statement confirming or disputing SlowMist's specific technical explanation. This claim should be treated as alleged pending a formal post-mortem from zkLink or a published SlowMist report that could be independently verified.","heading":"Alleged Root Cause","severity":"high","sources":[{"credibility":1,"name":"Unchained Crypto coverage of zkLink Nova bridge attack","type":"news_article","url":"https://unchainedcrypto.com/?p=50344"},{"credibility":2,"name":"zkLink Nova Bridge Drained of 786K After Forged Batch Root Exploit","type":"news_article","url":"https://coinranking.com/news/zklink-nova-bridge-drained-about-780000-forged-batch-root"}]},{"content":"Following disclosure of the attack, zkLink paused Nova block production and temporarily closed the withdrawal channel for the affected Arbitrator contracts on Ethereum and Optimism. The team reportedly patched the affected contracts and said it would conduct a full security review before resuming services, without providing a timeline. zkLink also offered the attacker a 20% white-hat bounty for voluntary return of the stolen funds, stating it would not pursue further legal action if the attacker cooperated. A separate bounty of up to 20% of recovered funds was reportedly offered to security researchers or white-hats who assist in fund recovery. As of the most recent available reporting, no outlet had confirmed recovery of the stolen funds or a final, zkLink-authored post-mortem.","heading":"Response and Mitigation","severity":"high","sources":[{"credibility":2,"name":"Phemex: zkLink Nova pauses block production, offers 20% white-hat bounty","type":"news_article","url":"https://phemex.com/news/article/zklink-nova-pauses-block-production-after-786k-bridge-attack-offers-20-whitehat-bounty-101760"},{"credibility":2,"name":"RootData: zkLink Nova contract under continuous attack, 20% white-hat bounty offered","type":"news_article","url":"https://www.rootdata.com/news/807161"},{"credibility":2,"name":"Odaily newsflash on zkLink bounty","type":"news_article","url":"https://www.odaily.news/en/newsflash/529322"}]},{"content":"zkLink Nova is described by the project and third parties as an aggregated Layer 3 zkEVM rollup network built on zkSync's ZK Stack, intended to pool liquidity across multiple Ethereum Layer 2 networks including zkSync Era, Linea, Arbitrum, Manta, and Mantle. zkLink-sourced announcements claimed the network's total value locked exceeded $1 billion by mid-2024, while independent third-party analyses placed peak TVL in the range of a few hundred million dollars, with TVL reportedly declining after incentive programs ended. Current TVL figures were not independently verified in this investigation.","heading":"Background: Project Overview","severity":"low","sources":[{"credibility":2,"name":"ChainCatcher: zkLink Nova TVL exceeds $1 billion","type":"news_article","url":"https://www.chaincatcher.com/en/article/2125269"},{"credibility":2,"name":"zkLink blog: All You Need To Know About zkLink","type":"official","url":"https://blog.zk.link/all-you-need-to-know-about-zklink-the-story-behind-ethereums-highest-valued-aggregated-layer-3-479c2e1a1e5c"}]}],"sources_used":[{"credibility":2,"name":"zkLink Nova Bridge Suffers $786K Forged Root Exploit","type":"news_article","url":"https://coinalertnews.com/news/2026/10/29/zklink-nova-bridge-786k-exploit"},{"credibility":2,"name":"zkLink Nova escrow drained via fake batch root","type":"news_article","url":"https://en.coinotag.com/zklink-nova-escrow-drained-fake-batch-root"},{"credibility":2,"name":"zkLink Nova Bridge Drained of 786K After Forged Batch Root Exploit","type":"news_article","url":"https://coinranking.com/news/zklink-nova-bridge-drained-about-780000-forged-batch-root"},{"credibility":2,"name":"ChainCatcher: zkLink cross-chain bridge coverage","type":"news_article","url":"https://www.chaincatcher.com/en/article/2300365"},{"credibility":1,"name":"Unchained Crypto coverage of zkLink Nova bridge attack","type":"news_article","url":"https://unchainedcrypto.com/?p=50344"},{"credibility":2,"name":"Phemex: zkLink cross-chain bridge under active attack","type":"news_article","url":"https://phemex.com/news/article/zklink-crosschain-bridge-under-active-attack-786k-stolen-via-forged-batch-root-injection-101680"},{"credibility":2,"name":"Phemex: zkLink Nova pauses block production, offers 20% white-hat bounty","type":"news_article","url":"https://phemex.com/news/article/zklink-nova-pauses-block-production-after-786k-bridge-attack-offers-20-whitehat-bounty-101760"},{"credibility":2,"name":"RootData: zkLink Nova contract under continuous attack, 20% white-hat bounty offered","type":"news_article","url":"https://www.rootdata.com/news/807161"},{"credibility":2,"name":"Odaily newsflash on zkLink bounty","type":"news_article","url":"https://www.odaily.news/en/newsflash/529322"},{"credibility":2,"name":"DefiLlama Hacks Tracker","type":"research","url":"https://defillama.com/hacks?id=5129"},{"credibility":2,"name":"ChainCatcher: zkLink Nova TVL exceeds $1 billion","type":"news_article","url":"https://www.chaincatcher.com/en/article/2125269"},{"credibility":2,"name":"zkLink blog: All You Need To Know About zkLink","type":"official","url":"https://blog.zk.link/all-you-need-to-know-about-zklink-the-story-behind-ethereums-highest-valued-aggregated-layer-3-479c2e1a1e5c"}],"summary":"zkLink Nova is an aggregated Layer 3 zkEVM rollup network built on zkSync's ZK Stack that pools liquidity across several Ethereum Layer 2s. In late October 2026, its Ethereum-side bridge/escrow contract was drained of roughly $780,000-$797,000 after an attacker allegedly injected a forged batch root through a public relayer, exploiting a message-hash reuse flaw reportedly located in the project's Arbitrator contract. zkLink paused Nova block production, closed withdrawals, and offered a 20% white-hat bounty for the return of funds; as of the most recent reporting, zkLink had not publicly confirmed the specific root-cause account given by security firm SlowMist.","timeline":[{"date":"2024-03","event":"zkLink announced the launch of zkLink Nova, described as the first aggregated zkEVM Layer 3 rollup network built on zkSync's ZK Stack.","source":"PlantAutomation Technology / zkLink announcements","source_url":"https://plantautomation-technology.com/news/zklink-announces-zklink-nova-the-first-aggregated-zkevm-layer"},{"date":"2024-05","event":"zkLink-sourced reporting claimed Nova's network TVL exceeded $1 billion, with over 530,000 independent wallet addresses.","source":"ChainCatcher","source_url":"https://www.chaincatcher.com/en/article/2125269"},{"date":"2026-10","event":"An attacker allegedly injected a forged batch root via a public relayer into zkLink Nova's Ethereum L1 custody/bridge contract, draining an estimated $780,000-$797,000 in ETH and ERC-20 tokens. Reports differ on whether the attack began October 28 or 29, 2026.","source":"Multiple crypto news outlets (Blockaid, SlowMist, Unchained Crypto, ChainCatcher, Coinalertnews)","source_url":"https://unchainedcrypto.com/?p=50344"},{"date":"2026-10","event":"zkLink paused Nova block production, closed withdrawals on affected Arbitrator contracts, patched the contracts, and offered a 20% white-hat bounty for return of the stolen funds.","source":"Phemex, RootData","source_url":"https://phemex.com/news/article/zklink-nova-pauses-block-production-after-786k-bridge-attack-offers-20-whitehat-bounty-101760"}]},"v":1}