zkLink cross-chain protocol loses about $783,000 in exploit
BREACHredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
zkLink, a multi-chain zk-rollup protocol, lost approximately $783,000 in an attack on 29 October 2026, according to SlowMist. The root cause lies in the Arbitrator contract's claimMessage function, which executes relayer-supplied calldata as the contract itself and reuses a stale transient storage value to pass its consistency check. An unprotected SyncL2TxHashRelayer contract served as the entry point, and the analysis indicates the attacker used this to forge withdrawal batch roots.
For IT people · Written by AI from 1 source · Wrong?
What to do
- If you have an account with the company, change that password, and anywhere you used the same one.
- Turn on two-step sign-in where you can.
- Expect scam emails and texts that mention the breach: contact the company yourself, not through links.
General advice for this kind of story
Full story timeline · 1 update
Who reported · 1 outlet
SlowMist