zkLink Nova Bridge Exploit Drains About $779,000 in One Transaction

The single-transaction nature of this drain points to a validation failure in how batch roots are accepted, not a gradual leak — a design-level weakness that matters for any bridge relying on similar proof mechanisms. The more pressing detail is the escrow contract's unpaused status after the alert, which suggests either delayed incident response or a governance process that cannot react quickly. For users of zkLink Nova and comparable rollup bridges, the question is whether the pause authority is functional and who holds it. Whether the escrow is secured before further withdrawals is the open question.