WiretechnologyDextape brief
One Fish, Multiple Meals — Analysis of the $780K zkLink Exploit
Background On October 29, 2026, the well-known cross-chain protocol zkLink was attacked, resulting in losses of approximately $783,000. The following is a detailed analysis of this incident by the SlowMist security team: Prerequisites zkLink is a multi-chain zk-rollup protocol.
Dextape brief
SlowMist's security team has analyzed an attack on the zkLink cross-chain protocol that caused losses of about $783,000 on October 29, 2026. According to the analysis, the weakness lay in a bridge function that both claims and relays cross-chain messages. An attacker reached it through an unprotected helper contract registered as a relayer, then reused leftover transient storage data to pass a validation step. A call routed through the gateways into ZkLink overwrote the log root of unexecuted batch 116409 with a self-built value.
With that root forged, a Merkle proof could validate a withdrawal message with arbitrary contents, letting the attacker take funds. The report, which walks through each step, attributes the failure to trusting relayer inputs and transient storage behavior.
Why it matters: It shows how a bridge that relies on relayer trust and transient storage checks can let a forged state root release funds.
Read the full story
Dextape context
Built from Dextape’s own wire, stories and glossary.
Mentioned in this story
Open a coin page for its current price.