zkLink cross-chain protocol loses about $783,000 in exploit
- Severity
- High
- Sources
- 1
What happened
SlowMist attributes the roughly $783,000 zkLink loss on 29 October 2026 to flaws in the Arbitrator contract's claimMessage function. The function lets a registered relayer execute arbitrary calldata against any address as the Arbitrator, which can reach onlyArbitrator-protected gateway functions, and its hash check reads a transient storage slot (EIP-1153) that persists across the whole transaction, so a second call can reuse a genuine claim's hash. The unauthenticated SyncL2TxHashRelayer.claimPrimaryChainSyncL2TxHashMessage was the entry point. No CVE IDs were given, and the article is truncated before the batch root forgery details and remediation advice.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- If you have an account with the company, change that password, and anywhere you used the same one.
- Turn on two-step sign-in where you can.
- Expect scam emails and texts that mention the breach: contact the company yourself, not through links.
General advice for this kind of story