Fake batch root drains zkLink Nova's Ethereum escrow down to 0.001 ETH

zkLink Nova’s Ethereum escrow was drained down to some 0.001 ETH on Wednesday by an attacker who used a public relayer to send a fake batch root. Blockaid, a security company, says that the amount of ETH and ERC-20 tokens taken so far is about $786,000. Blockaid flagged a public relayer attack at 10:24 p.m. ET Blockaid reported the attack in a post on X at 10:24 p.m. ET on October 28. The attacker used a public relayer to inject a fake root on Ethereum and then finalized ETH and ERC-20 withdrawals from Nova’s L1 escrow to receivers of their choosing. “~$786k drained from L1 ETH escrow and ERC20 bridge so far. Attack still ongoing,” wrote Blockaid.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to Cryptopolitan.