Google Analytics counts our visits, with cookies. No thanks turns it off and removes its cookies; in Europe, the UK, Switzerland and India, or wherever we cannot tell where you are, it stays off unless you accept. Cookie Notice

Advertise
PRICES
BTCETHSOLXRPBNBTONDOTLTCPOLHBARNEARARBUNI
Back to NewsFeeds

GoPlus says zkLink Nova bridge attack reused an authenticated message

NewsFeeds update

GoPlus says an attacker withdrew 22.43129453 ETH and 11 ERC-20 tokens, worth about $797,016.48, from zkLink Nova's L1 custody contract on 29 Oct. It says the Arbitrator.claimMessage function let an already authenticated message be reused.

EthereumCoinNessAIBearish

Read the original on CoinNess

The story so far: zkLink Nova bridge attack

An attacker used a public relayer to inject a forged batch root on Ethereum and finalised withdrawals from zkLink Nova's L1 escrow, stealing about $786,000. zkLink offered a 20% white hat bounty and halted Nova block production and withdrawals. zkLink now asks Optimism to freeze 224,133 OP tied to the 29 Oct escrow…

Headlines only, oldest first. Open a headline for the full update and the outlet it came from.

  1. zkLink bridge on Ethereum hit by ongoing attack, about $786,000 lost

  2. zkLink says Nova arbitrator contracts under attack on Ethereum and Optimism

  3. zkLink halts Nova block production and withdrawals after exploit

  4. GoPlus says zkLink Nova bridge attack reused an authenticated message

  5. zkLink sets out fund recovery plan for Nova incident

  6. zkLink loses about $783,000 in attack exploiting transient storage flaw, SlowMist says

  7. ZKLink asks Optimism to freeze 224,133 OP tied to escrow exploit

More Ethereum updates

  1. Large restaking holder redeems 7,500 ETH and sends it to Binance, Ai Yi says

    EthereumOdailyAIBearish

  2. Blockaid says EIP-7702 was key to $6.3bn Binance hot wallet theft

    EthereumChainCatcherAIBearish

  3. Machi sells three Bored Ape NFTs at a loss of $246,000

    EthereumPANewsAIBearish

Every Ethereum update on NewsFeeds

Every update is a short rewrite, by AI in our own words, of a flash from the outlet named on it, credited and linked. Updates are joined into one story by AI; our editors can change a story’s name or take an update out. Not investment advice.