zkLink Nova network suffers $786,000 exploit via forged batch root

An attacker successfully drained approximately $786,000 in cryptocurrency from the zkLink Nova Ethereum bridge. The exploit involved a forged batch root submitted through a publicly accessible relayer, which allowed the attacker to bypass cross-chain verification processes and authorize fraudulent withdrawals of Ether (ETH) and various ERC-20 tokens from escrow contracts.

In response to the breach, the zkLink team halted block production and temporarily suspended withdrawal channels on the zkLink Nova network to limit the scope of the attack. The technical team applied immediate fixes to the targeted Arbitrator contracts on Ethereum and Optimism and initiated a comprehensive security review of all related components. Services will remain suspended until the team confirms that all security risks have been eliminated.