On 29 October 2026 zkLink said it had identified an ongoing exploit against zkLink Nova’s Arbitrator contract on Ethereum and on Optimism. It told whoever was responsible to stop, on every chain, and to return the funds. The offer attached to that request was a 20 percent white-hat bounty, and a statement that no further action would be pursued if the funds came back. A later note the same day said block production on Nova was suspended, the affected contracts had been emergency-patched, and withdrawals had been switched off while the team reviewed every related component. Nova, zkLink said, comes back only after the project is sure the risk is gone. The notes give no loss figure, no timeline, and no description of how the contract was used. This page will not supply one.
zkLink Nova is the network the team calls an aggregated rollup. People hold assets on Nova. Those balances are claims on escrow that sits on other chains. Ethereum is one of those chains. Optimism, which zkLink named in the same sentence as the contract under attack, is another. The software that watches one side and releases coins on the other is a bridge. A bridge is extra software, not a tunnel. The coins do not travel. A message on one notebook causes a release on another. The wrong network is still the wrong city: a balance on Nova is not a balance on Ethereum, even when the ticker looks the same. What is Optimism (OP)? is the governance token of that other chain. Gas there is still ether. OP moving, or not moving, is not the escrow question.
What happened
Two clocks on 29 October, both the project’s, and neither of them a minute we will pretend to know more finely than the day. The first public note is the identification: Arbitrator contracts, Ethereum and Optimism, an appeal to return the funds, a 20 percent bounty. The second is the containment: Nova stopped producing blocks, withdrawals disabled, a review opened across the related components. Stopping the rollup freezes what is still on Nova. It does not pull back assets the escrow on Ethereum or Optimism had already released. That is the same shape as Initia’s halt on 23 October. Initia named a figure, about $2.7 million, and a bug in its own virtual machine. zkLink has named a contract and has not named either a figure or a mechanism.
On 30 October zkLink restated the bounty in two parts. A researcher whose information materially helps recovery may be eligible for up to 20 percent of the amount recovered. zkLink decides the eligibility and the amount. If the party responsible returns all of the funds, that party may keep 20 percent, and zkLink said it will not pursue further legal action in respect of the returned funds. The contacts it published are its own X account, @zkLink_Official, and team@zklink.org. A different handle, a different domain, or a form that asks you to connect a wallet “to claim the bounty” is not that offer.
Security firms published numbers the company did not. Blockaid’s alarm put the loss near $786,000 while the drain was still in progress. SlowMist later put it near $783,100. Unchained, which said it checked the Ethereum side and not Optimism, described the first pull as mostly tokens that represent restaked ether: about 245.7 pufETH and about 12.6 ezETH, plus other tokens, with about 22.43 ETH leaving Nova’s escrow. A later pull, the same firms said, took many more token types in small amounts, and the bulk of that pull’s value was about 216.4 million ZKL, on the order of $50,000 at the next day’s prices. A third withdrawal, of a fraction of an ETH, followed the next morning. Those are tracker counts of one side. zkLink has not confirmed them. It also has not confirmed the firms’ account of how a batch was accepted. ZKL is the project’s own token. A large count of ZKL at a thin price is not the same loss as the ether receipts, and adding the tracker dollars on top of a number zkLink never published will invent a total.
pufETH and ezETH are receipts. They are claims on ether that someone else has staked or restaked. They are not ether, and they are not stETH. What is Lido (LDO)? is the better-known version of that shape: a governance token beside a receipt, and the receipt is not the coin. Staking is a lock and a queue, not a savings account is the category. A bridge that releases the receipt is still a bridge.
Why it matters
If you held assets on Nova, you cannot withdraw until zkLink says the review is finished. The number on the Nova screen is a claim you cannot currently leave with. A patched contract is a change to the software. It is not a refund, and a 20 percent bounty is an offer to the person who has the coins, or to someone who helps find them. It is not a schedule that pays users 80 percent. DeFi is software with rules you cannot call support about. The support that exists here is the operator who stopped the chain and published an email address.
If you held ether, OP, or a restaking token on Ethereum or Optimism and never used Nova’s escrow, this page is someone else’s bridge. The Ronin hack was a bridge with too few keys, and Wormhole was a bridge bug. Different years, different holes. Wormhole’s users were made whole by a company, Jump, the next day. zkLink has not said it will do that. Do not import Jump’s choice into this week.
The day before, Humanode lost eHMND and kept its chain producing blocks while it froze a bridge vault. Nova did the other thing: the rollup stopped. A halt and a freeze are both availability decisions. Neither is a receipt.
What happens next
A review zkLink said must finish before Nova returns. A return of funds, if anyone takes the bounty, which would still leave users depending on what the project does with the 80 percent. A loss figure, if the project ever publishes one. Until then the honest range is the one above, labelled as trackers, and incomplete if Optimism moved too. Watch @zkLink_Official. We will not turn a missing total into $786,000 of fact, and we will not describe the contract.
Not a recommendation to bridge to Nova, to buy ZKL, or to write to the bounty address with a wallet seed. Not a finding that Ethereum or Optimism failed. The escrow software did. The notebooks underneath it kept going.
