zkLink Nova Bridge Drained of $786K After Forged Batch Root Exploit

An attacker drained approximately $786,000 in cryptocurrency from zkLink Nova’s Ethereum bridge after exploiting its cross-chain verification process to authorize fraudulent withdrawals.

The attack, detected by blockchain security firm Blockaid, involved submitting a forged batch root through a publicly accessible relayer. The malicious transaction enabled unauthorized withdrawals of Ether (ETH) and ERC-20 tokens from zkLink Nova’s Ethereum Layer 1 escrow contracts to addresses controlled by the attacker.

Blockaid identified the exploit late on October 28, 2026, and warned that the attack was still ongoing at the time of its disclosure. The full financial impact remains under investigation.

Forged Batch Root Allows Unauthorized Bridge Withdrawals

The attacker targeted zkLink Nova’s settlement infrastructure, which coordinates asset transfers between Ethereum and connected Layer 2 networks.

Under zkLink’s cross-chain settlement architecture, transaction batches are verified on Linea before their confirmed roots are relayed to secondary networks, including Ethereum, where they authorize withdrawals.

The attacker bypassed the expected verification process by injecting a fraudulent batch root through a public relayer. This allowed the Ethereum-side contracts to recognize unauthorized withdrawal requests as valid and release assets held in escrow.