Fake batch root drains zkLink Nova's Ethereum escrow down to 0.001 ETH

On Oct. 28, an attacker submitted a forged batch root through a public relayer on Ethereum and completed transfers from zkLink Nova's Ethereum escrow, leaving about 0.001 ETH in it, security company Blockaid reported. Blockaid estimated about $786,000 in ETH and ERC-20 tokens had been taken. Nova pools deposits from Ethereum and Layer 2 networks, holding assets in source-chain contracts and crediting them through its bridge; a batch root is a hash used to verify approved messages such as withdrawals. One transaction at 6:21 p.m. ET moved 22.43 ETH and 11 ERC-20 tokens, valued at $778,625.84, to a single address.