An attacker drained 22.43 ETH and 11 ERC-20 tokens, worth about $797,016, from zkLink Nova's L1 custody contracts on October 29 in a single transaction. The root cause was a flaw in Arbitrator.claimMessage: a message hash stored in transient storage was never cleared, and no fresh authentication callback was required, letting an authenticated message be reused. The attacker also impersonated the Ethereum Gateway via the publicly callable SyncL2TxHashRelayer to write a forged l2LogsRootHash for batch 116409, making forged withdrawals pass proof checks. zkLink suspended block production and emergency-patched the contracts, disabling withdrawals.

AI summary of the linked source — not editorial content.

Story signal · how it spread on X · via Elfa

as of
Spread
i
Distinct X and Telegram accounts Elfa counted behind this story’s reports, summed over the thread. Not posts, not impressions.
16 accounts

first post
Leviathan +31 h later

ETH reaction
i
Price change from the first post to 24 hours later (Hyperliquid). BTC over the same window is shown so a market-wide move is not mistaken for a reaction to this story. Not advice.
−5.1% 24h after post

$2,310 → $2,194
BTC −3.9% same window

Thread · 1 event
  1. First reportOngoing exploit drains about $786,000 from zkLink Nova’s Ethereum bridge16 acc.
  2. Leviathan published this article

All times UTC.

Cited posts

  • @blockaid_ BlockaidFirst reportOn X ↗

    🚨Blockaid detected an ongoing exploit on @zkLink_Official bridge on ethereum. Used a public relayer to inject a forged batch root on Ethereum, then finalized ETH and ERC20 withdrawals from zkLink Nova L1 escrow to attacker-chosen receivers. ~$786k drained from L1 ETH escrow and…

  • @wublockchain12 吴说区块链On X ↗

    据区块链安全公司 Blockaid 监测，zkLink Nova 在以太坊上的跨链桥正遭受攻击。攻击者利用公开中继器向以太坊注入伪造的批次状态根，随后将 zkLink Nova 在以太坊 L1 托管合约中的 ETH 及 ERC-20 资产提取至攻击者指定地址。截至 Blockaid 发布警报时，相关 ETH 托管合约及 ERC-20 跨链桥已损失约 78.6…

  • @exvulsec ExVulOn X ↗

    🚨 ALERT — Exploit on Ethereum zkLink Nova (@zkLink_Official) lost roughly $0.8M from its L1 escrows. An attacker installed a forged L2 logs root for batch 116409, then finalized 12 fake withdrawals with no corresponding L2 burn. Root cause: The allowlisted SyncL2TxHashRelayer…

Show 3 more cited posts
  • @CryptoTimes_io The Crypto TimesOn X ↗

    🚨 zkLink Nova bridge exploited for nearly $786,000. The attacker reportedly forged a batch root to bypass withdrawal verification. Draining 22.43 $ETH and 11 tokens, including $615K in $pufETH.@blockaid_ flagged the exploit, while @SlowMist_Team estimated losses at around…

  • @Phalcon_xyz BlockSec PhalconOn X ↗

    Our system detected a suspicious transaction targeting zkLink @zkLink_Official Nova, resulting in approximately $780K in losses. The root cause was flawed authentication-state verification in the Arbitrator, combined with a caller-controlled external call in the claim path. The…

  • @WYdaGOAT KennyWOn X ↗

    looks like there’s another bridge exploit, and this time it’s zklink nova around $800k was drained with most of the funds coming from 245.74 pufETH worth over $600k according to slowmist, the attacker exploited a flaw in the bridge’s arbitrator contract that allowed a fake…

10 more accounts posted about this · 1 Telegram channel (no public link)

TradersTrader calls tracked by Elfa · not advice

Positioning · ETH

Open2,852 open positions · 2,604 long · 248 short

Tracked accounts lean long about 97% of the time, so a long-heavy book is normal, not a signal. As of 30 Oct 09:13 UTC.

Reaction since the first post

Since 29 Oct 02:24 UTC30+ calls opened · 21 long · 9 short

Ongoing flow, not necessarily a reaction: Elfa returns at most 30 calls, so this count is a floor.

Callers with a scored record

@cryptoWZRD_ short · entry $2,208alpha +0.104 · 75% hit rate · 20 scored

Alpha, hit rate and sample size exactly as Elfa reports them.

Whole crypto market, not this story

Crowding0th percentile · vs last 28 days, 50 typical
Pulse 24h99/100 · unusualness of new calls, 0–100, 50 typical, higher means more long than usual
Book97.0% long · 10,758 accounts

As of 30 Oct 09:10 UTC.

Social-monitoring data, not investment advice Elfa prices Hyperliquid post text from Xas of

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…