zkLink loses $783,000 in transient-storage exploit
zkLink lost about $783,000 in an exploit on 29 October, according to security firm SlowMist. The attack used a transient-storage validation value that was neither cleared nor bound to the current call. After obtaining the value through a legitimate cross-chain message, the attacker reused it to forge a withdrawal batch root. They then completed 12 withdrawals: one in ETH and 11 in ERC-20 tokens. SlowMist’s findings highlight risks in zkLink’s withdrawal verification and contract access controls, as well as broader vulnerabilities in cross-chain infrastructure. No further developments are reported in the summaries. The direct trading impact is likely to focus on zkLink-related assets; wider market effects may remain limited unless additional losses or contagion emerge.
Bearish
The exploit is a negative signal for zkLink and assets directly associated with the protocol. In the short term, traders may react to the reported $783,000 loss by selling or reducing exposure amid concerns about withdrawal security, contract controls and possible further losses. This can increase volatility and weigh on related token prices, although the summaries do not identify a specific token-price move. Over the longer term, the effect will depend on zkLink’s response, whether the flaw is fixed and independently verified, and whether users regain confidence in the protocol. A contained incident may limit lasting pressure; additional exploits, unresolved vulnerabilities or contagion to other cross-chain services could extend the bearish impact. The summaries provide no evidence of broader market contagion so far.