# zkLink Nova bridge hit: About $786,000 withdrawn Author: Hatice Ertaş Language: English Published: 2026-10-29T09:42:48+03:00 Updated: 2026-10-29T11:16:23+03:00 ![A red junction diverts violet capsules into a side tube on a glass bridge between concrete walls.](https://kriptometa.com/uploads/zklink-nova-koprusune-saldiri-yaklasik-bin-dolar-cekildi-6caa557750fb_article.webp) ## Key takeaways - Blockaid’s October 29 alert at 02:24 UTC reported approximately $786,000 withdrawn by that point. - The Defiant reported that one transaction sent 22.43 ETH and 11 types of ERC-20 tokens to the same recipient. - The affected user count, final loss and any compensation timetable remain unknown. Blockaid says an attacker used a forged transaction summary to withdraw ETH and tokens from contracts on Ethereum. The firm described the attack as ongoing in its first alert early on October 29 UTC. Blockchain security firm Blockaid reported approximately $786,000 withdrawn in an attack on zkLink Nova’s [bridge on Ethereum](https://kriptometa.com/en/glossary/blockchain-bridge). In its [October 29 alert at 02:24 UTC](https://x.com/blockaid_/status/2115630787169050800), the firm said the attacker used a public message relayer to submit a forged transaction summary, then withdrew ETH and [ERC-20 tokens](https://kriptometa.com/en/glossary/token-networks-standards) to chosen recipients. It described the attack as ongoing when the alert was published. A batch root is a cryptographic summary representing a group of transactions. Blockaid’s initial finding concerns the bridge’s withdrawals; no evidence was presented of a broader compromise of Ethereum or the cryptography behind zero-knowledge proofs. ## What do the $786,000 and $779,000 estimates cover? [The Defiant’s report on Cryptonews.net](https://cryptonews.net/news/security/33668316/) places one withdrawal transaction at 22:21 UTC on October 28. The transfers it reviewed sent 22.43 ETH from Nova’s Ethereum ETH escrow and 11 types of ERC-20 tokens from its token bridge to the same recipient. Main transfers reported by The Defiant for one transaction | Asset | Amount transferred | |---|---| | ETH | Approximately 22.43 | | pufETH | Approximately 245.74 | | USDC | Approximately 18,113 | | USDT | Approximately 3,361 | The Defiant identified pufETH as the largest holding withdrawn, worth approximately $613,536 at the price then shown on [Etherscan](https://kriptometa.com/en/etherscan-review). The publication used the prices shown at 02:25 UTC on October 29 to value the ETH and token transfers at $778,625.84. The table shows ETH and three of the 11 token types. All four entries are included in the $778,625.84 total. The Defiant’s estimate of about $779,000 covers only the transaction it reviewed. Blockaid reported about $786,000 withdrawn from the ETH escrow and token bridge by the time of its first alert. Neither source explained the difference. The estimates concern the same attack and cannot be added together; the final total loss remains unknown. ## What assets did the bridge hold? zkLink Nova is a Layer 3 network that brings together assets from Ethereum and its [Layer 2 networks](https://kriptometa.com/en/glossary/layer-2-rollup). The project’s [official introduction](https://docs.zklink.io/) says assets deposited to Nova from Ethereum or other connected networks remain locked in [smart contracts](https://kriptometa.com/en/glossary/smart-contract) on the networks they came from. Through its canonical bridge, users can then access those assets on Nova. Blockaid [followed its alert](https://x.com/blockaid_/status/2115630789647868103) with two attacker addresses, an example transaction and the two affected contracts. [zkLink’s official address list](https://docs.zklink.io/developer/useful-addresses) identifies 0x5fD9…15Cf as the zkLink contract on Ethereum mainnet and 0xAd16…B6B6 as the ERC-20 bridge. Bridges deployed on Nova itself appear under separate addresses. The Defiant says the transaction logs record a new root before the ETH and token withdrawals within the same transaction. It also reports that a subsequent Etherscan view showed approximately 0.001 ETH left in the affected ETH escrow. That balance shows only the ETH left in that contract at the time. It does not show how much remained in Nova’s other contracts or the token bridge. ## What checks normally precede a withdrawal? zkLink identifies Linea as the primary chain for proof verification in its [settlement documentation](https://docs.zklink.io/architecture/settlement-layer). The sequencer submits a transaction batch and its [zero-knowledge proof](https://kriptometa.com/en/glossary/zero-knowledge-proof) to a verification contract on Linea. Contracts check the proof’s validity and compare summaries from the other connected chains with transactions relayed earlier. In the design zkLink describes, the batch becomes final after both checks succeed. The network sends its root to the other connected chains, whose contracts can then process withdrawal requests. Blockaid’s first alert did not explain which code check the attacker bypassed, how it was bypassed or whether the flaw had been fixed. The Defiant reported that the main Ethereum escrow’s pause setting was off (false) at 02:29 UTC on October 29. It cautioned that other safeguards might still prevent further attacks; the flag alone could not show whether the attack continued. Blockaid and The Defiant did not give an affected user count, the amount of any funds recovered or a compensation timetable. When this report was prepared, no incident statement was visible on zkLink’s homepage or in the displayed posts on its two official X profiles. The project’s other communication channels were not reviewed. The Blockaid post below was published at 02:24 UTC on October 29; its description of an ongoing attack refers to that time. [Blockaid’s October 29 zkLink Nova alert](https://x.com/blockaid_/status/2115630787169050800)