zkLink Nova confirms ongoing exploit of Arbitrator contract on Ethereum and Optimism; ~$786K drained from Ethereum bridge

zkLink Nova confirmed an ongoing exploit of its Arbitrator contract on Ethereum and Optimism. Blockaid flagged roughly $786K (78.6 ETH and ERC-20 assets) drained from its Ethereum bridge L1 custody contracts via a public relayer injecting forged batch state roots. SlowMist attributed the root cause to Arbitrator.claimMessage failing to clear a transient finalizeMessageHash, exploited through the publicly callable SyncL2TxHashRelayer.

Detected & updated continuously · Source: Nebula