zkLink Nova's bridge got drained twice. The second crew just followed the first one's footprints.
On Oct. 28 at 6:21 PM ET, one Ethereum transaction wrote a fake batch root into the bridge, then withdrew against it: 22.43 ETH plus 11 tokens, roughly $743K to $786K, mostly pufETH. No stolen keys. A public relayer and a security check that never reset did the work.
About nine hours later, contracts still unpatched, a different actor reused the trick on Optimism, Base, Blast and Mantle for about 24.76 ETH plus tokens, per Parapet Labs. Those escrows were "paused" in a 2025 wind-down. The pause only stopped deposits.
zkLink has since halted block production, patched, disabled withdrawals and offered a 20% bounty.
The pause button worked fine. It was just installed on the entrance.
Source: Parapet Labs post-mortem