zkLink Nova’s ETH escrow drained in $786,000 exploit, Blockaid says attack ongoing

On Wednesday, the Ethereum escrow on zkLink Nova was nearly emptied, with its balance reduced to approximately 0.001 ETH, following an attack involving a fake batch root submitted via a public relayer. Security company Blockaid, which monitors blockchain threats, reported that the losses reached around $786,000 in ETH and ERC-20 tokens. The exploit, first disclosed by Blockaid at 10:24 p.m. ET, is ongoing, with further risks not ruled out. Blockaid identified that the attacker exploited Nova’s system by using a public relayer to inject a fraudulent batch root on the Ethereum network. This manipulated the bridge’s withdrawal approval process, allowing the attacker to finalize unauthorized withdrawals of ETH and ERC-20 tokens from Nova’s Layer 1 escrow. The funds were then directed to addresses under the attacker’s control.

BeCrypto News shows a short excerpt and links to the publisher. The full report belongs to CoinTurk News.