A report says zkLink confirmed an ongoing attack on zkLink Nova’s Arbitrator contracts on Ethereum and Optimism. Blockaid was cited as estimating that about $786,000 in ETH and ERC-20 tokens had been taken from the project’s L1 custody contract. zkLink was reportedly working to contain further losses and offering a 20% white-hat bounty for the return of funds.

What Happened in the zkLink Nova Exploit

The report describes zkLink Nova as facing a sustained attack on its Arbitrator contracts across Ethereum and Optimism. zkLink said its technical team was urgently working to control the situation and prevent further losses, indicating that the incident was still considered active when it was disclosed rather than a completed event.

According to Blockaid, as cited in the report, attackers withdrew ETH and ERC-20 assets from zkLink Nova’s L1 custody contract. Estimated losses were about $786,000. This figure should be understood as a contemporaneous estimate of assets already withdrawn, rather than an independently confirmed final total of the protocol’s full exposure.

How the Reported Forged Batch-Root Attack Worked

According to Blockaid’s account, as cited in the report, the attack began when a forged batch root was injected into Ethereum through a public relay. This was followed by withdrawals from zkLink Nova’s L1 custody contract, where the reported ETH and ERC-20 token losses occurred.

That account outlines the alleged path taken by the funds, but it does not establish the precise technical failure that allowed the forged root to pass. Available details do not identify the specific validation flaw, permissions model, or contract-logic condition that accepted the batch root. The mechanism is therefore clearer than the root cause.

What zkLink’s 20% Bounty Means for Recovery

The report says zkLink urged the exploiter to stop interacting with zkLink Nova contracts across chains and return the affected funds. In return, the project said it would provide a 20% white-hat bounty and take no further action once the funds had been returned. In practice, this is a negotiated recovery offer intended to secure the assets’ prompt return.

The offer does not demonstrate that recovery has been completed. The same report does not establish that the exploit had been stopped, that relevant functions had been paused, or that any funds had been returned. The latest supported status is narrower: containment was reportedly underway, the attack was described as ongoing at the time of disclosure, and recovery efforts centered on a bounty-backed request to return the funds.