zkLink Nova Bridge Hacked for $786,000 in Forged Attack

Published October 29, 2026, 8:20 AM PKT. Based on security firm Blockaid's monitoring as reported by PANews, The Defiant, BBX and KuCoin on October 29, 2026 (primary and secondary sources below). This is the first MABOnChain article on the zkLink Nova bridge attack, and it is distinct from the October 29 coverage of the suspected Hifi Finance governance attack, the October 24 coverage of the X100 governance takeover and the October 23 coverage of the Initia network halt.

The zkLink cross-chain bridge on Ethereum came under attack on October 29, 2026, draining about $786,000 from its layer-1 escrow contract, according to security firm Blockaid's monitoring as reported by PANews. The attacker injected a forged batch root onto Ethereum through a public relayer, then used it to finalize withdrawals of ETH and ERC20 tokens from zkLink Nova's escrow contract to an attacker-controlled address, the reports said. At the time the first reports appeared, the attack was still ongoing.

The first public reports landed within minutes of each other in the early hours of October 29. PANews published its report at 02:27 UTC, BBX at 02:28 UTC, The Defiant at 02:33 UTC and KuCoin's flash desk, carrying ChainThink's account of Blockaid's monitoring, at 02:46 UTC. The Defiant's on-chain check put the single withdrawal transaction at about $779,000, a figure consistent with the roughly $786,000 total cited by the other reports, with the small gap explained by the difference between one transaction and the running total across the escrow and the ERC20 bridge.

A forged batch root through a public relayer

The mechanism Blockaid described is what makes this attack notable. A batch root is a cryptographic summary of a batch of bridge transactions, and the Ethereum-side contract trusts it as proof that withdrawals are legitimate. By injecting a forged root through a public relayer, a permissionless message carrier that anyone can use, the attacker convinced the contract to release funds for withdrawals that had no matching deposits behind them, according to Blockaid's account as reported by PANews and BBX.

The attack did not need a private key theft, a governance vote or a flash loan, the routes used in the Hifi, X100 and Initia incidents earlier in the week. It needed only a flaw in how the bridge validated the batch root it was handed. That distinction matters for other bridges: a validation check that accepts a forged proof is a single point of failure, and it can be exploited by anyone who can reach a public relayer, with no insider access required.

About $786,000, and the attack was still running

The reported loss, about $786,000 from the layer-1 ETH escrow and the ERC20 bridge combined, is smaller than the week's other incidents: about $1 million at Hifi Finance, about $2.6 million at Initia and about $4.85 million at X100. But the qualifier attached to it is what raises the stakes. Blockaid's monitoring described the attack as still ongoing when the first reports appeared, which means the $786,000 figure was a floor, not a final total, and further withdrawals were possible until the bridge was paused or the flaw was closed.

Whether more funds left the escrow after the first reports is not established in the coverage reviewed for this article. No report cited a zkLink statement, a pause transaction or a revised loss figure, and readers should treat the total as preliminary until zkLink or an independent security firm publishes an updated accounting.

An escrow contract left unpaused

The most alarming detail in the early coverage is the state of the contract after the warning. The Defiant reported that the main Ethereum escrow still showed an unpaused status after Blockaid warned that the forged batch root had enabled unauthorized withdrawals. An unpaused escrow means the withdrawal path the attacker used remained open, so the window for further losses stayed open too, unless zkLink acted after the reports reviewed here were published.

Bridges have been crypto's most expensive failure point for years because they concentrate funds in a single contract that must trust messages from another chain. The zkLink case follows that pattern exactly: the escrow held real ETH and ERC20 tokens on Ethereum, the proof it trusted came from outside, and the check on that proof failed. Until zkLink confirms a pause, a fix or a recovery, users with funds still bridged through zkLink Nova should assume the route is unsafe.

What remains unconfirmed

Four questions decide how serious this incident becomes. First, whether zkLink confirms the attack and publishes its own accounting of what was drained. Second, whether the escrow has since been paused and the validation flaw fixed, which would cap the loss at the reported figure. Third, whether any of the drained funds can be frozen or recovered, which depends on where they moved after leaving the escrow, a trail the current reports do not follow. Fourth, whether the attack exploited a known vulnerability or a novel one, which determines how many other bridges share the exposure.

Until zkLink speaks, the practical position for users is caution: the reports describe a bridge whose escrow was drained through a forged proof, with the attack ongoing and the contract unpaused at the time of reporting, and no source reviewed for this article reports a fix, a pause or a recovery. MABOnChain will update this story if zkLink publishes a statement or if security researchers revise the figures.

This article is news reporting and is not investment advice.

Sources

• PANews, zkLink Cross-Chain Bridge on Ethereum Under Attack, Approximately $786,000 Lost (October 29, 2026), primary source (carries Blockaid's monitoring of the attack)
• The Defiant, zkLink Nova Bridge Exploit Drains About $779,000 in One Transaction (October 29, 2026), secondary source
• BBX, The zkLink cross-chain bridge on Ethereum is under attack, resulting in a loss of approximately $786,000 (October 29, 2026), secondary source
• KuCoin, Blockaid Detects Attack on zkLink Cross-Chain Bridge, $786,000 Lost (October 29, 2026), secondary source