zkLink Nova suffered an attack with losses of approximately $797,000, and the official block production has been suspended

According to an analysis by the blockchain security agency GoPlus, on October 29, attackers extracted 22.43 ETH and 11 types of ERC-20 tokens from the Ethereum L1 custody contract of the aggregated Layer2 network zkLink Nova through a single transaction. The total value calculated at the time of the attack was approximately $797,000.

The vulnerability originated from the claimMessage function of the Arbitrator contract, which did not clear the temporarily stored message hash, allowing verified messages to be reused. The attackers exploited the publicly callable authorization relayer SyncL2TxHashRelayer to forge the L2 batch root and execute false withdrawals. The zkLink team has confirmed the attack, suspended block production on the Nova network, urgently patched the affected contracts, and temporarily closed the withdrawal channel, with a comprehensive security check to follow.