Blockaid: zkLink Cross-Chain Bridge Under Attack, Approximately $786,000 Stolen

TechFlow reported that on October 29, according to on-chain security firm Blockaid, zkLink's cross-chain bridge on Ethereum is under attack. The attacker injected a forged batch root into Ethereum through a public relayer, then withdrew ETH and ERC20 tokens from zkLink Nova's L1 custody contract to attacker-specified receiving addresses. As of now, the L1 ETH custody contract and ERC20 cross-chain bridge have lost approximately $786,000, and the attack remains ongoing.

Blockaid has published two attacker addresses, sample attack transactions, victim contracts, and bridge addresses. One of the attacker addresses (0xaCA0...5718) currently has a balance of approximately $11,000.

Source: TechFlow