zkLink Nova Halts Blocks After Bridge Exploit Exceeds $780,000

zkLink Nova has halted block production and paused withdrawals after attackers used its Ethereum bridge to remove assets worth more than $780,000. The incident centers on Nova’s Arbitrator contract, which helps authorize withdrawals. The network’s team says it has patched affected contracts, but Nova will remain offline while engineers review connected components and assess whether the fixes address the full risk.

In a Thursday morning update, the team said services would return only after it had “fully confirmed that all risks have been eliminated.” It did not provide a restart date, a final loss figure or its own explanation of the exploit. That leaves users with an immediate operational question: when can they access assets through Nova again?

The team had acknowledged the incident roughly four hours earlier. It said the attacker targeted the Arbitrator contract on both Ethereum and Optimism, and asked for the funds to be returned. The team offered a “20% white hat bounty” and wrote: “No further action will be pursued if funds are returned.” Those public statements describe the team’s response, but don’t confirm how the exploit succeeded or how much was taken across both networks.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

What the Ethereum transactions show

On-chain activity gives a partial view of the withdrawals. As of 3:50 p.m. ET Thursday, Nova’s Ethereum escrow contract reported that it was paused. The data reviewed by Unchained did not establish when the pause took effect. That distinction matters: a paused contract can block further activity through that component, but the timestamp alone doesn’t show when the team responded or whether other parts of the system were affected.

The first identified exploit transaction was confirmed at 6:21 p.m. ET on Oct. 28. It drew assets from two contracts. About 245.7 pufETH, worth more than $600,000 at Thursday prices, accounted for most of the value. The transaction also removed 10 other token types, including about 12.6 ezETH, while Nova’s escrow released around 22.43 ETH.

A second transaction followed at 9:43 p.m. ET. Security firm SlowMist flagged the activity; Unchained also confirmed it on-chain. A different wallet withdrew 33 token types from the bridge, mostly in small quantities. The largest item by reported value was about 216.4 million ZKL, zkLink’s token, worth roughly $50,000 at Thursday prices. That wallet still held about 1.24 ETH and most of the tokens it had taken, according to the article’s review.

A third withdrawal, for about 0.0025 ETH, came from another wallet at 6:06 a.m. ET Thursday. It repeated the steps used in the first transaction. By Thursday afternoon, the wallet associated with that first exploit held no pufETH, USDC, USDT or WBTC and less than 0.001 ETH; about 2.5 mswETH and 2.6 mstETH remained. Unchained’s transaction review covered Ethereum only, so it does not establish the full activity on Optimism.

What investigators say about the exploit

Blockaid raised the alarm at 10:24 p.m. ET Wednesday. The security firm said the attacker “used a public relayer to inject a forged batch root on Ethereum,” enabling withdrawals of ETH and tokens to addresses selected by the attacker. While the activity was still underway, Blockaid put the amount taken at about $786,000.

SlowMist estimated the loss at about $783,100 and described a possible weakness in the Arbitrator contract. In its account, a function let the attacker reuse a message hash that had already been valid, set a chosen batch root and submit forged proofs to withdraw funds. The two estimates are close, but zkLink has not confirmed either firm’s account. They should therefore be read as security firms’ assessments, rather than a final tally or a confirmed technical postmortem.

The reported mechanism points to a key part of bridge security: contracts must check that withdrawal proofs correspond to authorized messages and batches, and that valid messages cannot be replayed in a way that approves new withdrawals. A batch root summarizes a group of transactions; if a system accepts an attacker supplied root without adequate checks, its proof process may authorize transfers that were never intended. The public information so far does not explain which checks failed in Nova’s implementation, or whether the same issue affected other components.

For users and developers, the immediate impact is the loss of normal network activity and access through paused withdrawals. The team’s contract fixes are one step; its stated review of related components will determine whether it finds additional exposure before restoring service. Until zkLink publishes more detail, the timeline for reopening and the final scope of the incident remain unknown. The next useful update will need to clarify what changed in the contracts, which networks and assets were affected, and how the team verified the remaining withdrawal paths.

The incident follows other reported losses in the sector. A day earlier, Blockaid flagged a flash-loan exploit that removed about $1 million in USDC from an Avalanche-based tranche vault. Earlier in the month, Initia halted its chain after an attacker minted tokens and bridged out about $2.7 million, according to co-founder Zon’s estimate; the chain had no restart date at the time. Separately, a Blockaid report said attackers still held $287 million in stolen crypto that could not be frozen. These cases involve different systems and methods, but each shows why monitoring withdrawals and pausing affected components can become central to a team’s response.

Related Listen: Why Aave’s Unified Pool Turned a Bridge Hack Into $193M in Bad Debt

The post zkLink Nova Goes Offline After Hacker Steals More Than $780,000 From Its Bridge appeared first on Unchained.