Security1 hOctober 30, 2026, 06:05

zkLink Nova exploit: forged root drains ~$780K

On 28 October 2026 an attacker emptied zkLink Nova's Ethereum escrows, taking 22.43 ETH and 11 ERC-20 tokens (including ~245.74 pufETH) worth roughly $780K. The flaw: Arbitrator.claimMessage() checked a transient finalizeMessageHash it never reset and executed a caller-supplied target and calldata under its own trusted identity. zkLink halted block production, emergency-patched the contracts and disabled withdrawals.

DEV Community

Open source

zkLink Nova exploit: forged root drains ~$780K

22.43 ETH and 11 ERC-20 tokens stolen, losses estimated at $743K–$805K
Root cause: finalizeMessageHash in transient storage was never cleared
claimMessage() ran arbitrary target and calldata as the trusted Arbitrator
zkLink halted blocks, patched contracts and temporarily disabled withdrawals

#ZkLink#Ethereum#Linea

ChainVeil attack hides malware in vite.config.js via forged merge commit

Security

Yapeswap drained after zero-quorum governance vote handed over factory

Security

Argent-style Ethereum smart wallet exploit drains $59.8K

Security

zkLink Nova exploit: forged root drains ~$780K

ChainVeil attack hides malware in vite.config.js via forged merge commit

Yapeswap drained after zero-quorum governance vote handed over factory

Argent-style Ethereum smart wallet exploit drains $59.8K

KolanHook Exploit: Unguarded Uniswap v4 Buyback Drained ETH