zkLink Nova Bridge Exploit Drains About $779,000 in One Transaction

zkLink Nova is a zkEVM rollup that relies on an Ethereum-based escrow contract to hold assets until withdrawal proofs tied to a batch root are verified, the same architecture that made earlier bridges like Ronin and Nomad attractive targets when validation logic had gaps. Batch roots are meant to summarize a set of Layer 2 transactions for Ethereum to check; bypassing that check has been the recurring failure mode in bridge hacks since 2022.

Anyone holding assets bridged through zkLink Nova's Ethereum escrow now faces a contract drained to roughly 0.001 ETH, meaning legitimate withdrawal claims cannot be honored until the team restores funds or issues compensation. Developers must rebuild the withdrawal-root verification function that let a forged batch root pass, and other rollups using similar relayer-based proof submission have reason to audit their own restrictions before an attacker finds the same gap.

A public relayer being able to submit a fake batch root that the escrow accepted shows how much of a 'trustless' bridge still depends on one function behaving correctly, not on cryptographic proof alone. The incident sits in a line of rollup and bridge failures where the promise of validity proofs did not extend to the contract guarding the money, a gap worth naming plainly rather than treating as an isolated bug. (per thedefiant.io)

The open question is whether zkLink Nova's main escrow, which Blockaid found still unpaused after its warning, gets locked down and whether the team can trace or negotiate return of the roughly $786,000 taken. A formal incident report with a patched withdrawal function, or an on-chain message to the attacker, would mark the next concrete step; silence past that point would leave bridged users without recourse.

EthereumETH the event is about this asset

The move was larger before the first headline than after. That is an observation, not an explanation: the market also moves on things nobody publishes.