Worked example · 2026-10
zkLink Nova — the L1 Arbitrator did not clear a claimed message hash, so a public relayer's hash was reused to install a forged withdrawal root — zkLink Nova / Ethereum — 2026-10-29
Summary
SlowMist flagged the exploit on 2026-10-29 with two Ethereum transactions. Attacker addresses 0xaca0655a11200a80d33d0e48786317304cde5718 and 0xDAB137F390dF77caA97fd492540E973fd5e2F8c8; vulnerable Arbitrator 0x1ee09a2caa0813a5183f90f5a6d0e4871f4c6002.
Timeline (UTC)
Read it as three stages. Flaw: a message-verified flag that outlives the message. Take: populate a hash, reuse it to install a forged root, withdraw with forged proofs. After: nothing public beyond the alert. Times are from the SlowMist alert.
| When | What happened | OAK |
|---|---|---|
| Before 2026-10-29 (since when: undisclosed) | Arbitrator.claimMessage does not clear the transient finalizeMessageHash or require a fresh authenticated callback for each call. The SyncL2TxHashRelayer is publicly callable yet authorised, so anyone can populate a valid hash. |
T10.002 |
| Before the exploit (undisclosed) | Funding and preparation of the two attacker addresses are not published. | — |
| 2026-10-29 (before 02:41 UTC) | Through SyncL2TxHashRelayer the attacker first populates a valid message hash. |
T10.002 |
| 2026-10-29 (same sequence) | The attacker reuses the hash while substituting EthereumGateway.sendMessage as the claim target. This runs ZkLink.syncBatchRoot under the legitimate gateway identity and installs an attacker-chosen l2LogsRootHashes root. No key is compromised. |
T10.002 |
| 2026-10-29 (same sequence) | Using forged proofs against that root, the attacker withdraws about $783.1K from the ZkLink and L1ERC20Bridge escrow contracts. SlowMist lists two Ethereum transactions, 0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462c and 0x8a7e38b9c2a7a40981317ba87fbaa2e50527ec412cefc2fb4c9e3184f8848ae9, without saying which step each is. |
— |
| 2026-10-28 22:21:35 and 2026-10-29 01:43:11 | Traced by OAK: the two listed transactions are the withdrawals, the first from attacker 1 (22.43 ETH plus nine tokens) and the second from attacker 2 (216.4M ZKL). The first predates the alert by about four hours. | T10.002 |
| 2026-10-28 22:28 to 2026-10-29 05:53 | Traced by OAK: attacker 1 sells the tokens, spreads 303 ETH over three wallets and swaps it to DAI (about 702K DAI held by transfer events). Attacker 2 sells 22M of 216M ZKL on CoW Protocol and Uniswap V4. See Fund flow. | — |
| 2026-10-29 02:41:32 | SlowMist TI alert. No zkLink pause, statement, post-mortem or compensation plan appears in the cited sources: undisclosed. | response |
Key addresses:
- Attacker 1 (traced by OAK) —
0xaca0655a11200a80d33d0e48786317304cde5718 - Attacker 2 (traced by OAK) —
0xDAB137F390dF77caA97fd492540E973fd5e2F8c8 - Victim (ZkLink) —
0x5fd9f73286b7e8683bab45019c94553b93e015cf - Victim (L1ERC20Bridge) —
0xad16edcf7deb7e90096a259c81269d811544b6b6 - Vulnerable contract (Arbitrator proxy) —
0x1ee09a2caa0813a5183f90f5a6d0e4871f4c6002 - Arbitrator implementation —
0x7a0bb4805ecb7fd3c8dabbe4afa0e91cb1761e34 - Transaction 1 —
0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462c - Transaction 2 —
0x8a7e38b9c2a7a40981317ba87fbaa2e50527ec412cefc2fb4c9e3184f8848ae9 - DAI holding wallets (traced by OAK) —
0x211b4aebefea02470587286b398ed28fb7e09c6a,0x2d5a8aabf7af4022e314eb2a54753ba2402bafb0,0x75dcf3395b6cbefc6b66b28d6d93f193b58dc0f3
Fund flow
Ethereum leg, traced by OAK with tools/explorer.py (Blockscout, keyless) on 2026-10-30. Edges marked traced by OAK were checked on-chain. Counterfeit-token transfers were excluded (trusted: false: MSWETH, MSTETH in transaction 1; MMETH, rnETH, nETH, MWBETH in transaction 2). Only Ethereum is involved. The trace window ends on 2026-10-30 (about one day after the exploit, not three) because that is today.
All transfers as a table (28)
What the trace adds beyond the sources:
- Timing. Transaction 1 ran at 2026-10-28 22:21:35 UTC and transaction 2 at 2026-10-29 01:43:11 UTC. SlowMist's alert is dated 2026-10-29 02:41:32, so the first withdrawal came about four hours before the alert and a day earlier than the timeline's "2026-10-29" wording implied. Transaction 1 was sent by attacker 1 to
0xd5f162b68a0281686e8dc76db8d67d2f3e6aff07; transaction 2 by attacker 2 to0x61f4f8eda80a1138178ca81a2c0f70642fb6f402. Both are withdrawals. The forged-root installation steps are not either of the two listed transactions. - What each took. Transaction 1 took 22.43 ETH from ZkLink and nine tokens from the L1ERC20Bridge (listed in the first edge); two further transfers (MSWETH, MSTETH) are counterfeit and excluded. Transaction 2 took 216,437,891.95 ZKL plus dust-sized amounts of about 30 long-tail tokens (UNIBTC, UNIETH, SWETH, GAL, USDE, MNT, COLON and others).
- Attacker 1 liquidated within hours. The wallet routed PUFETH, USDC, WBTC, RSETH, STONE, USDT, RSWETH and WSTETH through Curve and MetaMask Swaps routers between 22:28 and 22:44 UTC on 2026-10-28, then moved 303 ETH (proceeds, mostly from the PUFETH sale) to three fresh holding wallets. Those wallets swapped the ETH and EZETH into DAI between 00:21 and 00:56 UTC on 2026-10-29. By transfer events (not a live balance query) they hold about 268,344 DAI, 211,963 DAI and 221,848 DAI (about 702,155 DAI in total), which is consistent with SlowMist's ~$783K once the smaller token sales and DAI already moved on are added. OAK does not convert amounts to dollars.
- Attacker 2 sold only a fraction of the ZKL. Of 216.44M ZKL it sold 386,412 on CoW Protocol and 21.6M into Uniswap V4. About 194.4M ZKL (216,437,891.95 less the two sales) has not moved since, by transfer events. This is a limit, not a freeze.
- Same operator, probably. Both attackers sent exactly 0.0021 ETH to the Linea L1 message service on 2026-10-28 (at 17:49 and 22:38 UTC). Attacker 2 existed since 2026-09-18 and made small test transfers on 2026-09-23. Attacker 1 was first funded on 2026-10-28 15:49 UTC. Treat the common Linea step as a link, not proof.
- Limits. The six onward wallets in the graph (full addresses in the nodes) each received 2 to 25,000 of one asset and now hold nothing; they were not followed. The wallet
0x8f10b468b06c6fd214b65f87778827f7d113f996received attacker 2's long-tail tokens but trades tens of thousands of dollars every few minutes on 2026-10-30, so it is probably a swap bot or aggregator-linked wallet, not an attacker wallet. It is not followed. Funding sources of both attackers are unlabelled and not followed further. No exchange deposit, mixer or freeze was observed in this window. No issuer or zkLink action is reported in the cited sources.
Root-cause evidence
- Technique: OAK-T10.002
- Source: https://x.com/SlowMist_Team/status/2115635114638250409
- Source type: security-firm
- Confidence: reported
- Evidence: SlowMist's trace analysis names the function, the reused transient hash, the relayer path and the forged root; no zkLink post-mortem yet.
Public references
[slowmistzklink2026]— SlowMist TI alert (2026-10-29): https://x.com/SlowMist_Team/status/2115635114638250409[etherscanzklink2026]— exploit transaction: https://etherscan.io/tx/0x4f3c23e75b9134e8cae5a462550daad42fbbc19242567fcc34c0a035e297462c