zkLink Nova contracts under attack; project offers 20% bounty for cooperation

Huo Xing Cai Jing reports that zkLink, an aggregation rollup infrastructure provider, has confirmed an ongoing attack on its aggregated Layer 3 network zkLink Nova. The attack targets Arbitrator contracts on Ethereum and Optimism. zkLink said its technical team is working urgently to contain the situation and prevent further losses, and will update the community shortly. The project urged all parties involved to stop exploiting zkLink Nova smart contracts on any chain and to return the affected funds. If the attackers cooperate in returning the funds, zkLink is prepared to offer a 20% bug bounty and will not pursue the matter further once the funds are returned. Security firm Blockaid previously observed the attacker injecting forged batch roots through public relayers on Ethereum, then withdrawing ETH and ERC20 tokens from the zkLink Nova L1 custody contract. At the time, combined losses from the L1 ETH custody and ERC20 bridge totaled about $7.86 million, and the attack is still ongoing.