SlowMist
CompanySecurity timeline
- Named in breach reports by SlowMistzkLink cross-chain protocol loses about $783,000 in exploit
Recent news
SlowMist and JunHe LLP host Hong Kong institutional RWA and stablecoin forum
SlowMist and JunHe LLP co-hosted a Hong Kong forum during FinTech Week on RWA issuance, stablecoin payments, institutional compliance and on-chain security. Keynotes covered zero-trust controls across people, systems and code, and AI-driven attack trends, and SlowMist promoted its MistTrack and SlowMist KYT tools for anti-money-laundering screening.
zkLink cross-chain protocol loses about $783,000 in exploit
zkLink, a multi-chain zk-rollup protocol, lost approximately $783,000 in an attack on 29 October 2026, according to SlowMist. The root cause lies in the Arbitrator contract's claimMessage function, which executes relayer-supplied calldata as the contract itself and reuses a stale transient storage value to pass its consistency check. An unprotected SyncL2TxHashRelayer contract served as the entry point, and the analysis indicates the attacker used this to forge withdrawal batch roots.