Blockaid flags attack on zkLink Nova cross-chain bridge on Ethereum, ~78.6 ETH and ERC-20 assets lost

Blockchain security firm Blockaid detected an ongoing attack on zkLink Nova's cross-chain bridge on Ethereum, with roughly 78.6 ETH and ERC-20 bridge assets drained from L1 custody contracts via a public relayer injecting forged batch state roots. SlowMist attributed the root cause to Arbitrator.claimMessage failing to clear a transient finalizeMessageHash, exploited through the publicly callable SyncL2TxHashRelayer.

Detected & updated continuously · Source: Nebula