zkLink Nova suffered a bridge exploit on Ethereum on Oct. 28, with an attacker withdrawing assets worth approximately $778,625 in a single transaction. Blockchain security firm Blockaid said the attacker used a public relayer to introduce a forged batch root, enabling withdrawals to attacker-controlled addresses.
The transaction was executed at 6:21 p.m. ET and involved 22.43 ETH and 11 types of ERC-20 tokens transferred from Nova's Ethereum escrow and token bridge to the same recipient. The Defiant calculated the combined value using prices displayed by Etherscan at 10:25 p.m. ET.
The largest portion of the withdrawal consisted of 245.74 pufETH, valued at approximately $613,536 by Etherscan. The transaction also included around 18,113 USDC and 3,361 USDT, alongside ETH and other tokens.
The Defiant reported a combined transaction value of $778,625.84 based on the displayed prices of the transferred assets. That figure represents the value of the identified transaction, not a final estimate of the total losses associated with the incident.
According to Blockaid, the attacker exploited the bridge's authorization process by using a public relayer to submit a forged batch root, a cryptographic summary used to verify messages. The attacker then finalized withdrawals directed to addresses of their choosing.
zkLink Nova aggregates assets across Ethereum and its Layer 2 networks. Deposits are locked in smart contracts on their respective source chains and subsequently made available on Nova through its canonical bridge.
Under zkLink's documented settlement process, proof verification and cross-chain consistency checks are performed before a transaction batch is finalized. The batch root is then transmitted to connected chains to authorize withdrawals. Blockaid's account indicates that a forged root entered this process, allowing the attacker to proceed with the withdrawals.