Blockaid: zkLink Cross-Chain Bridge Attacked, Approximately $786,000 Stolen

On October 29, according to on-chain security firm Blockaid, zkLink's cross-chain bridge on Ethereum is under attack. The attacker injected forged batch roots into Ethereum via a public relayer, then withdrew ETH and ERC20 tokens from zkLink Nova's L1 custody contract, transferring them to addresses specified by the attacker. To date, the L1 ETH custody contract and ERC20 cross-chain bridge have lost approximately $786,000, and the attack remains ongoing.

Blockaid has disclosed two attacker addresses, example attack transactions, victim contracts, and cross-chain bridge addresses. One attacker address (0xaCA0...5718) currently holds a balance of approximately $11,000.