zkLink Nova

An attacker exploited zkLink’s Arbitrator contract, which failed to clear a previously authenticated message hash after processing a claim. By reusing that hash through the publicly accessible SyncL2TxHashRelayer, the attacker impersonated an authorized gateway message and installed a malicious L2 logs root.

The attacker then submitted forged withdrawal proofs against the compromised root to drain approximately $783,100 from zkLink’s Ethereum bridge.