All incidents · Oct 29, 2026
zkLink Nova bridge attestations were reused
zkLink NovaBridgeOngoingEthereum, Optimism
On October 29, 2026, a security firm disclosed that zkLink Nova's bridge on Ethereum had been drained. SlowMist estimated about $783,000. The project confirmed that the Arbitrator contract was under attack. It paused block production and withdrawals, and offered to let returned funds keep 20% as a white-hat bounty. The project did not publish its own loss figure.
Other figures
- Loss780,000USDBlockSec Phalcon · as of Oct 29, 2026
Sequence
Newest first · UTC
Oct 292026 · Thu
Block production and withdrawals were paused
Halt · zkLink · @zkLink_Official
zkLink said it had paused zkLink Nova block production, was patching the related contracts on an emergency basis, and had temporarily closed the withdrawal channel. The technical team was doing a full check. Service would resume only after the risks were confirmed to be gone. As of this update, there was no public figure for funds returned or for compensation.
zkLink Nova services will only be restored after we have fully confirmed that all risks have been eliminated.
The project confirmed the attack and offered a 20% white-hat bounty
Confirmation · zkLink · @zkLink_Official
zkLink said the attack then underway targeted the Arbitrator contracts of zkLink Nova on Ethereum and Optimism. The technical team had emergency control of the situation. The post asked that the attack stop and the funds be returned. If they were returned, it offered a 20% white-hat bounty and said it would not pursue the matter further. The post did not state a dollar loss.
No further action will be pursued if funds are returned.
Phalcon gave another figure, about $780,000
Technical · BlockSec Phalcon · @Phalcon_xyz
Phalcon also placed the problem in the Arbitrator's attestation state. A hash left by one legitimate claim could still be used by the next claim before the transaction ended. The post estimated the loss at about $780,000. Assets it listed as withdrawn included about 22.43 ETH and about 245.74 pufETH. The two security firms' dollar figures are close. The asset breakdown follows the original post.
Our system detected a suspicious transaction targeting zkLink Nova, resulting in approximately $780K in losses.
SlowMist estimated the loss at about $783,000
Alert · SlowMist · @SlowMist_Team
SlowMist summarized the cause this way. The Arbitrator's claimMessage did not clear a one-time attestation hash, and it did not require a fresh attestation on every call. The attacker therefore installed a batch root of their own choosing and withdrew assets with a forged proof. This is a security firm's alert. It is not the project's confirmation of the loss.
@zkLink_Official Loss: ~783.1k