BTC 
ETH 
BNB 
XRP 
SOL 
TRX SlowMist reports ~783.1k loss in zkLink exploit via Arbitrator flaw
SlowMist's threat-intelligence alert states that zkLink lost approximately 783.1k after an Arbitrator.claimMessage flaw failed to clear the transient finalizeMessageHash, allowing a reused hash through the authorized SyncL2TxHashRelayer. The post says the attacker substituted EthereumGateway.sendMessage as the claim target, executed ZkLink.syncBatchRoot under the legitimate gateway identity, installed an attacker-chosen l2LogsRootHashes root and withdrew assets using forged proofs. It lists two attacker addresses, ZkLink and L1ERC20Bridge as victims, and the Arbitrator contract and implementat
Why “Unverified”
- Reported by SlowMist alone, with no second source or primary confirmation yet
1 independent source group across 1 post · evidence score 72/100. How labels work
Other reports on this event
Its sources described the event in different words, so it was kept as a separate story with its own label. How reports are linked
What the sources claim
-
SlowMist attributes a loss of roughly 783.1k to an Arbitrator.claimMessage flaw that failed to clear the transient finalizeMessageHash.
“Loss: ~783.1k”
SlowMist -
The attacker reused a valid hash through the publicly callable, authorized SyncL2TxHashRelayer while substituting EthereumGateway.sendMessage as the claim target.
“the attacker first populated a valid hash, then reused it while substituting EthereumGateway.sendMessage as the claim target”
SlowMist -
The exploit executed ZkLink.syncBatchRoot under the legitimate gateway identity and installed an attacker-chosen l2LogsRootHashes root.
“installed an attacker-chosen l2LogsRootHashes root, and withdrew assets using forged proofs”
SlowMist -
SlowMist identifies the Arbitrator contract as the vulnerable contract in the incident.
“Vulnerable Contract: Arbitrator 0x1ee09a2caa0813a5183f90f5a6d0e4871f4c6002”
SlowMist
Sources
- 🚨SlowMist TI Alert🚨 → slowmist.ai
More in Hacks & Security
Summary and claims extracted by AI with prompt analyze-story@5 on 2026-10-30 00:00 UTC. Labels are computed from the sources, not by the model.