zkLink Nova Attack Causes About $797,000 in Losses as Network Halts Block Production

zkLink Nova was attacked on October 29, resulting in estimated losses of about $797,000. According to ChainCatcher, blockchain security firm GoPlus said the attacker used a single transaction to withdraw 22.43 ETH and 11 types of ERC-20 tokens from the network’s Ethereum Layer 1 custody contract. The vulnerability was in the Arbitrator contract’s claimMessage function, which failed to clear a temporarily stored message hash, allowing a verified message to be reused. The attacker used the publicly callable SyncL2TxHashRelayer to forge an L2 batch root and execute fraudulent withdrawals. zkLink confirmed the attack and said it had halted block production on Nova, urgently patched the affected contracts, and temporarily suspended withdrawals. The team plans to conduct a comprehensive security review.