Blockchain security firm Blockaid detected an ongoing exploit against zkLink Nova’s bridge on Ethereum, reporting that an attacker used a public relayer to inject a forged batch root. The attacker then finalized ETH and ERC-20 withdrawals from Nova’s Layer 1 escrow to addresses of their choosing. Blockaid estimated roughly $786,000 had been drained when it issued the alert. The incident centers on forged withdrawal verification within the bridge infrastructure.
🚨Blockaid detected an ongoing exploit on @zkLink_Official bridge on ethereum.
Used a public relayer to inject a forged batch root on Ethereum, then finalized ETH and ERC20 withdrawals from zkLink Nova L1 escrow to attacker-chosen receivers.
~$786k drained from L1 ETH escrow and…— Blockaid (@blockaid_) October 29, 2026
A batch root is a cryptographic commitment used to verify withdrawal data. By getting a forged root accepted on Ethereum, the attacker was able to submit withdrawals that appeared valid to the bridge contracts and release escrowed assets. Blockaid said both ETH and ERC-20 assets were affected. The security firm described the attack as still ongoing at disclosure, making the reported loss a preliminary figure.
The key issue now is whether the exploit has been contained and what final loss the investigation establishes. Further updates are needed to identify the underlying vulnerability, the complete set of affected assets and any remediation measures. Until then, the $786,000 figure should be treated as Blockaid’s running estimate rather than a final accounting of the incident.
Source: Blockaid.
Disclaimer: Crypto Economy Flash News are based on verified public and official sources. Their purpose is to provide fast, factual updates about relevant events in the crypto and blockchain ecosystem.
This information does not constitute financial advice or investment recommendation. Readers are encouraged to verify all details through official project channels before making any related decisions.
