zkLink Nova Bridge Drained for About $783,000 in Forged Root Exploit

zkLink Nova’s bridge has been reported drained for about $783,100 after an attacker allegedly used a forged batch root to trigger unauthorized withdrawals, according to a SlowMist incident entry. The loss came from the protocol’s cross-chain bridge flow, where Ethereum-side escrow contracts were apparently made to accept fraudulent withdrawal instructions.

The incident record says the exploit involved a forged root, a mechanism used in bridge verification, and that the attacker was able to pull assets from zkLink Nova’s bridge contracts. The publicly listed estimate places the loss at roughly $783,100, though other early coverage cited figures closer to $786,000.

Bridge verification, not token markets, was the target

The reported attack focused on the bridge’s settlement process rather than on price action or trading activity. In practical terms, that means the issue centered on how withdrawals were authorized across chains, not on a market move in the token itself. The loss is tied to assets held in the bridge’s escrow contracts on Ethereum.

Secondary reporting indicated that the drained funds included ETH and ERC-20 assets, but the exact composition and final total have not been fully settled across early reports. The incident database entry is the clearest available public record tying the exploit to zkLink Nova and assigning the approximate loss figure.

At the time of the record, no broader recovery or reimbursement update was attached to the incident listing. As with many bridge exploits, the key unresolved point is whether the affected contracts were paused quickly enough to stop further withdrawals or whether any assets were recovered after the unauthorized drain.