zkLink Nova, a crypto network built by the zkLink team, has stopped producing blocks after an attacker pulled more than $780,000 out of the bridge that links it to Ethereum on Wednesday evening. In a Thursday morning update, zkLink said it had also rushed out fixes to the affected contracts and temporarily switched off withdrawals while engineers review every related component.

“zkLink Nova services will only be restored after we have fully confirmed that all risks have been eliminated,” the team wrote on X. It gave no timeline, no loss figure and no cause.

Four hours earlier, zkLink acknowledged the attack, saying it targeted Nova’s Arbitrator contract on both Ethereum and Optimism, and asked whoever was responsible to stop and send the money back. In that post on X, the team offered a “20% white hat bounty” and added: “No further action will be pursued if funds are returned.”

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

What the Chain Shows

As of 3:50 p.m. ET Thursday, Nova’s escrow contract reported itself as paused, according to Unchained’s read of Ethereum data, though the data doesn’t show when the pause began. On Thursday afternoon, the wallet behind the first exploit transaction had moved almost everything it took: it held no pufETH, USDC, USDT or WBTC and less than 0.001 ETH, though about 2.5 mswETH and 2.6 mstETH remained.

That first transaction, confirmed at 6:21 p.m. ET on Oct. 28, drew funds from two contracts at once. Restaked ether made up most of its value: about 245.7 pufETH, worth more than $600,000 at Thursday prices, left the token bridge with 10 other tokens, including about 12.6 ezETH, while Nova’s escrow released about 22.43 ETH.

Security firm SlowMist flagged a second transaction, sent about three hours later at 9:43 p.m. ET, in which another wallet pulled 33 more token types from the bridge, most of them in small amounts, with about 216.4 million of zkLink’s own ZKL token, worth roughly $50,000 at Thursday prices, making up the bulk of the value; Unchained confirmed it onchain, and that wallet still held about 1.24 ETH and most of the tokens it took. A third withdrawal, of about 0.0025 ETH, went through from a different wallet at 6:06 a.m. ET Thursday, repeating the first transaction’s steps. Unchained checked only the Ethereum side, not Optimism.

How the Attack Worked

Blockaid raised the alarm at 10:24 p.m. ET Wednesday. It said the attacker “used a public relayer to inject a forged batch root on Ethereum,” which let it sign off on ETH and token withdrawals and route them to receivers it picked. With the drain still in progress, Blockaid counted about $786,000 gone.

SlowMist estimated about $783,100. It traced the problem to a function in the Arbitrator contract that let the attacker reuse an already-valid message hash, install a batch root it picked and withdraw with forged proofs. zkLink has not confirmed either firm’s account.

The drain came a day after Blockaid flagged a flash-loan attack that took about $1 million from an Avalanche-based tranche vault. Earlier this month, Initia’s chain went offline with no restart date after an attacker minted tokens and, by co-founder Zon’s estimate, bridged out about $2.7 million, and a Blockaid report found hackers still hold $287 million in stolen crypto that can’t be frozen.

Related Listen: How a Bug Bounty Can Buy a Lambo Without the Jail Risk