zkLink Nova Bridge Exploit Drains About $779,000 in One Transaction

zkLink Nova is a ZK rollup that settles proofs and processes withdrawals through escrow contracts on Ethereum, with a relayer posting batch roots that attest to valid cross-chain transfers. That design mirrors the architecture behind earlier bridge failures such as Ronin in 2022 and Wormhole the same year, where an attacker who could forge or hijack the message-verification step could authorize withdrawals the contract had no way to independently check.

Users with assets locked in zkLink Nova cannot withdraw while the network has stopped producing blocks and engineers review every related contract, leaving bridged ETH and ERC-20 holders waiting on a fix timeline zkLink has not published. Liquidity providers and integrated apps on Nova are frozen in the same window, and the team has already had to ship emergency patches to the affected escrow contracts rather than a planned upgrade.

The exploit used a public relayer to inject a forged batch root through what SlowMist described as an improperly restricted function, which points to an access-control gap rather than a cryptographic break in the rollup's proofs. That distinction matters: a flaw in who is allowed to submit a root is a permissions failure any team can patch, but it still shows how much a 'trustless' bridge can depend on a narrow, poorly guarded function call.

zkLink's Thursday update promised contract fixes and a withdrawal pause while every related component gets reviewed, but it gave no date for resuming block production or restoring withdrawals. Whether the team publishes a post-mortem naming the exact function that was exploited, and whether it offers any reimbursement for the roughly $783,100 to $786,000 in reported losses, will determine how much confidence bridge users and integrated protocols place in Nova going forward.

EthereumETH the event is about this asset

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.