On Wednesday, the Ethereum escrow on zkLink Nova was nearly emptied, with its balance reduced to approximately 0.001 ETH, following an attack involving a fake batch root submitted via a public relayer. Security company Blockaid, which monitors blockchain threats, reported that the losses reached around $786,000 in ETH and ERC-20 tokens. The exploit, first disclosed by Blockaid at 10:24 p.m. ET, is ongoing, with further risks not ruled out.
Batch root forgery and exploit mechanism
Blockaid identified that the attacker exploited Nova’s system by using a public relayer to inject a fraudulent batch root on the Ethereum network. This manipulated the bridge’s withdrawal approval process, allowing the attacker to finalize unauthorized withdrawals of ETH and ERC-20 tokens from Nova’s Layer 1 escrow. The funds were then directed to addresses under the attacker’s control.
Blockaid highlighted that approximately $786,000 had been drained from both the ETH escrow and the ERC-20 bridge contract, and noted that the attack was still in progress at the time of reporting.
Nova operates as an asset aggregation bridge, pooling assets from Ethereum and affiliated Layer 2 networks. Users’ deposits remain secured on their source chains, while credits are issued on Nova through its canonical bridge mechanism.
A batch root is a cryptographic hash employed by bridges to validate withdrawal requests and transactions. In zkLink’s architecture, settlement procedures require batch root verification and cross-chain proof validation before any withdrawals are executed.
According to Blockaid, the attacker bypassed intended safeguards by using the public relayer to inject the fake batch root. The malicious root allowed the processing of illegitimate withdrawal requests, resulting in swift asset transfers to the attacker.
Mini dictionary: Public relayer — A node or infrastructure that forwards transactions or proofs on behalf of users or protocols to public blockchains. While relayers simplify transaction management, improper security controls can make them a point of vulnerability for exploits such as unauthorized batch root submissions.
Key transactions and funds drained
A critical transaction associated with the attack occurred at 6:21 p.m. ET on October 28. During this incident, the attacker withdrew 22.43 ETH and 11 ERC-20 tokens from Nova’s escrow and bridge contracts, transferring the entire amount to a single address.
The stolen assets included 245.74 pufETH, valued at about $613,536, in addition to 18,113 USDC, and 3,361 USDT. Etherscan data showed that this single transaction amounted to $778,625.84. Since this figure does not include all related transactions, the total losses may be higher.
| Asset | Amount | Approximate USD Value |
|---|---|---|
| pufETH | 245.74 | $613,536 |
| USDC | 18,113 | $18,113 |
| USDT | 3,361 | $3,361 |
| ETH | 22.43 | Included above |
| Total | $778,625.84 |
Blockaid identified two wallet addresses used by the perpetrator, designating the ERC-20 bridge contract as an additional target. Etherscan confirmed that after the attack the ETH escrow was nearly emptied, showing a balance of only 0.001 ETH. By 10:29 p.m. ET, the escrow’s pause functionality had not been triggered, leaving uncertainty about any further protective measures being enforced.
Wider context: previous bridge attacks
The incident follows similar exploits on cross-chain bridges in recent months. Just 11 days earlier, attackers leveraged a fake mint message to create 10 million unauthorized CYS tokens on Cysic’s cross-chain bridge, with 7.2 million of those tokens subsequently sold. The attacker’s wallet transferred roughly $727,000 to Ethereum before the address was blacklisted by the project.
In July, the Verus Ethereum bridge lost $7.54 million in its second exploit. Another breach in May drained $11.58 million, both incidents reportedly tied to the same flawed contract and route. Investigations revealed that the root cause in May was missing validation code in the checkCCEValues function, a pattern seen in other high-profile bridge attacks such as the Wormhole and Nomad exploits.
