BTC 
ETH 
BNB 
XRP 
SOL 
TRX SlowMist reports zkLink exploit of about $783K via transient storage flaw
SlowMist reported that cross-chain protocol zkLink was exploited for approximately $783K on October 29, 2026, attributing it to a transient storage flaw that enabled forged batch roots and unauthorized withdrawals. SlowMist described an attack flow in which a stale finalizeMessageHash was reused to forge a batch root and execute 12 withdrawals, and said the root cause involves Arbitrator.claimMessage allowing relayers to specify arbitrary call targets and calldata.
Why “Unverified”
- Reported by SlowMist alone, with no second source or primary confirmation yet
1 independent source group across 1 post · evidence score 72/100. How labels work
Market around the story
| Asset | Price at first report | 6h before | 1h before | 1h after | 6h after | 1h move vs normal | 24h volume vs median |
|---|---|---|---|---|---|---|---|
| ETH | $2,250 | +0.28% | +0.18% | −0.03% | +0.17% | 0.1σ | 0.5× |
Returns are measured from the moment the story first appeared. “vs normal” compares the move with the asset's typical hourly move over the previous 30 days.
What the sources claim
-
SlowMist says zkLink was exploited for roughly $783K on October 29, 2026.
“cross-chain protocol @zkLink_Official was exploited for approximately $783K”
SlowMist -
SlowMist attributes the incident to a transient storage flaw that led to forged batch roots and unauthorized withdrawals.
“a transient storage flaw led to forged batch roots and unauthorized withdrawals”
SlowMist -
The attacker reused a stale finalizeMessageHash in a second claimMessage call, per SlowMist.
“Reused the stale finalizeMessageHash in a second claimMessage call”
SlowMist -
SlowMist says 12 withdrawals were executed against the forged root, including 1 ETH and 11 ERC-20 transfers. ETH
“Executed 12 withdrawals against the forged root: 1 ETH and 11 ERC-20 transfers”
SlowMist -
SlowMist states the root cause is that Arbitrator.claimMessage lets relayers specify arbitrary call targets and calldata.
“Arbitrator.claimMessage allows relayers to specify arbitrary call targets and calldata”
SlowMist
Sources
More on ETH
Summary and claims extracted by AI with prompt analyze-story@5 on 2026-11-01 00:00 UTC. Labels are computed from the sources, not by the model.