zkLink Nova bridge (October 2026) hack — October 2026

At 22:21 UTC on 28 October 2026 an attacker drained zkLink Nova’s bridge to Ethereum by faking withdrawal approvals. According to Unchained’s read of the chain, the first transaction took about 245.7 pufETH and ten other tokens from the token bridge and about 22.43 ETH from Nova’s escrow. A second wallet pulled 33 more token types about three hours later, most of the value being about 216.4 million ZKL, and a third withdrew a trivial amount the next morning. SlowMist puts the loss at about $783,100; Blockaid’s early alert said about $786,000.

SlowMist traced the cause to Arbitrator.claimMessage, which failed to clear a transient message hash. Through a relayer that anyone could call, the attacker populated a valid hash, then reused it to run syncBatchRoot under the legitimate gateway identity, installed its own root and withdrew against forged proofs.

zkLink said on 29 October that the exploit targeted the Arbitrator contract on Ethereum and Optimism, suspended Nova block production, patched the contracts and disabled withdrawals. It has given no loss figure, and on 30 October it renewed a 20% bounty for returned funds. Losses on chains other than Ethereum have not been counted here.