zkLink Nova’s Ethereum bridge is drained of about $779,000 with a forged batch root; zkLink offers a 20% bounty

An attacker drained about $779,000 from the Ethereum contracts of the zkLink Nova bridge on 28 October, in a single transaction confirmed at 22:21 UTC. According to security firm Blockaid, which raised the alert about four hours later, the attacker pushed a forged batch root onto Ethereum through a public relayer and then finalised withdrawals of ETH and tokens to an address of their choosing. zkLink spoke at 09:06 UTC on 29 October: it called the exploit “ongoing” and offered the attacker a 20% bounty to return the funds.

The transaction on Etherscan shows two contracts paying out at once. The one Etherscan labels “zkLink Nova: zkLink contract”, which holds the ETH, sent 22.43 ETH. The “zkLink Nova: ERC20 Bridge” contract sent 11 different tokens. Everything went to the same wallet, the one that had signed the transaction. Cryptopolitan, using Etherscan prices, put the whole withdrawal at $778,625.84.

Estimates of the loss differ by a few thousand dollars, mostly because each source priced the tokens at a different moment. Blockaid gave an interim figure of about $786,000 and described the attack as ongoing. DefiLlama’s hacks database, queried at about 11:55 UTC on 29 October, lists $783,100. zkLink has not given a figure.

What left the zkLink Nova bridge, token by token

More than three quarters of the loss is a single asset: pufETH, the liquid restaking token issued by Puffer. The rest is a spread of other restaking and staking tokens, two stablecoins and a little wrapped bitcoin.

Cryptopolitan put the pufETH alone at about $613,500 at Etherscan’s price. The ETH was worth about $52,000 at the price Etherscan showed at 11:58 UTC on 29 October. For readers who hold tokens like pufETH, ezETH or rsETH and want to know what they are, our guide to restaking and liquid restaking tokens explains how they are issued and redeemed.

How a forged batch root got through, according to Blockaid

Nova does not settle directly on Ethereum. Transactions are grouped into batches, the batches are checked, and a short fingerprint of each one, the batch root, is sent to the chains where users withdraw. On Ethereum, contracts holding the deposited assets release a withdrawal when it matches a root they have accepted. TokenPost described this design in its report on the attack.

Blockaid’s account, as relayed by Cryptopolitan and TokenPost, is that the attacker injected a root that did not correspond to any genuine batch, using a public relayer, and then used it to finalise withdrawals from Nova’s Ethereum escrow to “receivers of their choosing”. The event logs of the transaction fit that sequence: a SyncBatchRoot event, events from the Linea L1 Message Service, then WithdrawalFinalized events, all inside one transaction that cost about 0.00116 ETH in fees.

The transaction did not call zkLink’s contracts directly. It went through a contract with no published source code, 0xD5f162B6…f3E6Aff07, which Etherscan shows the receiving wallet itself deployed at 18:51 UTC, three and a half hours before the drain. That contract has made no other transaction.

What Blockaid’s summary does not explain is the decisive step. Nobody has said publicly how a forged root passed the contract’s checks. zkLink’s own post names a third piece, its “Arbitrator” contract on Ethereum and Optimism, as the target, without saying what went wrong in it. No outlet reported evidence of stolen administrator keys. DefiLlama files the incident as “Cross-Chain Message Spoofing”, a classification, not a finding.

The pattern is familiar. Earlier this month NEAR Intents published a postmortem on a bug that let a fake deposit notification mint $3.8 million in ghost funds: there too, a system acted on a message it should have rejected. Our explainer on how cross-chain bridges and messaging work covers where those messages come from and who is supposed to check them.

Where the money went in the first 40 minutes

Coindaro read the receiving wallet’s history on Etherscan at about 11:55 UTC on 29 October. Its first ETH, 0.027 ETH, arrived at 15:49 UTC on 28 October from an address Etherscan labels “FixedFloat: Hot Wallet 2”. FixedFloat is an instant blockchain, where users swap tokens directly from their own wallets without handing custody of their funds to a company.">swap service; the label is Etherscan’s tag for that address and says nothing on its own about who bought the ETH. At 16:01 UTC the wallet deposited 1 USDC into the Nova ERC-20 bridge. At 17:49 UTC it sent a message through Linea’s L1 Message Service, and at 18:51 it deployed the contract used in the attack.

The conversion started three minutes after the withdrawal. At 22:24 UTC the wallet redeemed 132 pufETH through Puffer for 141.95 wrapped ETH, and at 22:28 it sold the other 113.73 pufETH on Curve for 123.26 ETH. The USDC and the WBTC were swapped on Curve for 32,157.74 DAI in total. Between 22:42 and 22:44 UTC five more swaps went through MetaMask’s swap router, turning the rsETH, STONE, USDT, rswETH and proof of stake coin with a protocol that stakes it for you and issues a transferable token (such as Lido stETH or rETH) representing the deposit plus rewards, which you can use or sell while the coins stay staked.">wstETH into ETH.

Then the ETH left in three transfers within three minutes. At the ETH price of $2,324 recorded at 11:46 UTC on 29 October, the 303.06 ETH sent is worth about $704,000.

By the time Blockaid posted its alert at 02:24 UTC, the wallet had been mostly empty for more than three hours. When Coindaro checked, it still held about $11,000 in mswETH and mstETH. We did not trace the three destination wallets further, and no outlet has reported transfers to a mixer such as Tornado Cash. Blockaid said it had identified two attacker addresses, but the outlets that relayed its alert did not list them, so we cannot say whether they match these.

zkLink offers a 20% bounty and calls the exploit ongoing

zkLink’s first word came on its X account @zkLink_Official at 09:06 UTC on 29 October, almost 11 hours after the transaction. The team said it had identified “an ongoing exploit targeting zkLink Nova’s Arbitrator contract on Ethereum and Optimism” and that its engineers were working to contain it. It asked those responsible to stop and return the funds, offering a 20% white hat bounty and saying no further action would be pursued if they did.

The post gives no loss figure and no cause. It does not say whether anything was taken on Optimism, whether the Ethereum contracts are paused, or whether users who bridged assets will be repaid. The bounty is twice the 10% that the Cysic bridge team offered its exploiter earlier this month; that offer was followed a day later by the exploiter sending 300 ETH to Tornado Cash.

The contracts kept working as before. Cryptopolitan reported that the ETH escrow’s pause flag still read “not paused” at 02:29 UTC, with about 0.001 ETH left inside, and The Defiant also said the escrow was still unpaused after the warning. Etherscan shows two users’ deposit requests into the same contract going through at 01:28 and 06:05 UTC on 29 October; at 11:58 UTC the contract held about 0.62 ETH.

At 11:19 UTC an address that submits batch updates to the escrow called a function named “Open Range Batch Root Hash”. The same address made the same call every day from 20 to 28 October, so on its own it does not show a change of course.

What zkLink Nova is, and what ZKL holders were promised

zkLink Nova is a layer 3 network built on Linea, itself a layer 2 on Ethereum. It was pitched as an aggregator that would smart contract holding reserves of two or more tokens, supplied by users, that a decentralized exchange uses to execute trades automatically at a price set by a formula.">pool assets from several Ethereum layer 2 networks in one place. L2BEAT classifies it as a validium: transaction data is not posted to Ethereum, and a single sequencer makes the data roots available.

Mainnet went live on 11 March 2024, and the “Aggregation Parade” points season started three days later, according to a sponsored post on The Block. The zkLink team later claimed $1.05 billion in deposits within two months, a figure no independent tracker confirmed. The ZKL token has a supply of 1 billion; the first NovaDrop claim opened on 22 July 2024 at 12:00 UTC with 5% of supply. Coindaro found no report of a ZKL price reaction to the exploit.

What Nova bridge users can check now

zkLink’s post contains no instructions for users, so what follows is information Coindaro gathered, not guidance from the project. The two Ethereum contracts are public and anyone can watch them on Etherscan: the ETH escrow at 0x5fD9F73286b7E8683Bab45019C94553b93e015Cf and the ERC-20 bridge at 0xAd16eDCF7DEB7e90096A259c81269d811544B6B6. Both appear by name in the attack transaction.

• In the design TokenPost describes, assets bridged to Nova are backed on Ethereum by those two contracts. With them drained, how future withdrawals would be paid is an open question that zkLink has not addressed.
• No fix to the root check had been announced by midday UTC on 29 October, and the escrow was still accepting deposit requests at 06:05 UTC.
• zkLink’s 09:06 UTC post mentions no refund or claim process. Fake “refund” and “claim” pages are a common sequel to bridge hacks, so any such page would not come from that post.
• The figures in this article may change: both Blockaid and zkLink described the attack as ongoing, and zkLink named Optimism as well as Ethereum.

The next marker is a reply from the attacker to the bounty offer, or zkLink’s account of how the forged root was accepted. Until then, the record is one transaction on Ethereum, Blockaid’s explanation of it and 303 ETH that left the receiving wallet within 40 minutes.