Ongoing Attack on zkLink Cross-Chain Bridge Results in $786,000 Loss
Written with artificial intelligence.
An ongoing attack on the zkLink cross-chain bridge on Ethereum has been reported, resulting in a theft of approximately $786,000. The attackers are exploiting public relayers to inject fake batch roots, confirming withdrawals of ETH and ERC20 tokens from zkLink Nova's L1 custody contract.
Attack Details
According to monitoring by Blockaid, the zkLink cross-chain bridge on Ethereum is currently under attack. The attackers are using public relayers to inject forged batch roots, which allows them to finalize withdrawals of ETH and ERC20 tokens from zkLink Nova's Layer 1 custody contract. These funds are then redirected to addresses specified by the attackers.
As of now, the total amount stolen from the L1 ETH custody and ERC20 bridge has reached approximately $786,000. The attack is still ongoing, and further developments are being closely monitored.
Implications
This incident highlights the vulnerabilities present in cross-chain bridge protocols and the risks associated with using public relayers, which can be manipulated for unauthorized access. Users of zkLink and similar platforms should be vigilant and consider the security measures in place.
For ongoing updates and detailed investigations into this and other incidents, stakeholders are encouraged to follow developments closely as they unfold.