zkLink confirms an ongoing exploit against Nova Arbitrator contracts on Ethereum and Optimism
zkLink confirms an exploit targeting Nova Arbitrator contracts on Ethereum and Optimism. SlowMist reports bridge withdrawals and points to message-state handling. The vendor has not provided a final loss total or verified fix in the notice read.
- Disclosed
- Oct 29, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Users with assets in zkLink Nova bridge custody; the vendor names Arbitrator contracts on Ethereum and Optimism
- crypto
- In the wild
- Yes
- zkLink explicitly acknowledges an ongoing exploit against its Arbitrator contracts.
What happened
The vendor acknowledgment establishes a real exploit, supporting L4 even while the full technical report is unavailable. SlowMist attributes the failure to Arbitrator.claimMessage retaining transient message state without a fresh authenticated callback. That is a research assessment, not a published vendor post-mortem.
SlowMist estimates about $783,100. This is an early researcher estimate, unverified outside that investigation, not a final vendor-confirmed loss, a current reserve balance or a reimbursement figure. The official notice names Ethereum and Optimism but does not quantify loss separately on either chain.
The available primary text does not establish a completed patch, a paused bridge, recovery payments or a safe reopening time. The precaution against adding bridge exposure is editorial containment advice derived from the vendor’s ongoing-exploit warning, not a claim that the project has ordered a specific withdrawal procedure.
Crime-scene timeline
Oct 29, 2026
zkLink confirms ongoing exploitation and says containment is in progress
Oct 29, 2026
SlowMist publishes its preliminary message-state analysis
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- zkLink official exploit acknowledgmentPrimaryThe visible text names ongoing exploitation of Nova Arbitrator contracts on Ethereum and Optimism and says containment is underway; the remainder is truncated.
- SlowMist original analysisPrimaryThe visible research post estimates about $783,100 and identifies uncleared transient message state in claimMessage; the longer technical continuation is truncated.
- SlowMist Hacked event indexDiscovery index for this same event; not independent confirmation of the original SlowMist analysis.