Digital Asset
Intelligence
Security Incident · ETH Ecosystem

zkLink Nova Smart Contract Vulnerability: $783.10K Reported Loss

·Source-attributed incident record

Incident Overview

The zkLink Nova cross-chain bridge (Ethereum L1 escrow contracts) was exploited. The attacker abused a publicly callable authorized SyncL2TxHashRelayer and a flaw in the Arbitrator contract (failure to clear transient finalizeMessageHash), first populating a valid hash then reusing it to install an attacker-chosen l2LogsRootHashes root under the legitimate gateway identity, enabling withdrawals of ETH and ERC20 assets via forged proofs.

Sources & References

Original incident referencehttps://x.com/SlowMist_Team/status/2115635114638250409 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Binance

    Attack methodDevOps Engineer’s Laptop Compromised
    Reported loss$ 6,300,000,000
  2. Incident date
    Attack methodAccount Credentials Stolen
    Reported loss$ 133000000
  3. Incident date
    Attack methodHot Wallet Key Compromise
    Reported loss$ 856,000
  4. Incident date
    Target

    Yapeswap

    Attack methodGovernance Attack
    Reported loss$ 21900
  5. Incident date
    Attack methodSupply Chain Attack
    Reported loss$ 2,700,000