Threat video1:00
zkLink Nova Bridge Escrow Drain: Detection & IOCs
One Ethereum transaction drained about $780K from zkLink Nova's escrows by forging a batch root. The free Splunk SPL rule leads 9 detection rules and 7 IOCs.
Read the full threat intel for zkLink Nova bridge exploit (~$780K): uncleared transient hash in… →
Chapters
- 0:00The hookAbout $780K drained from zkLink Nova bridge.
- 0:05The storyHash validation never cleared.
- 0:12Attack pathBuild an attack contract for the Arbitrator flaw.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromise3 indicators to hunt: 3 smart contracts.
- 0:37MITRE ATT&CK techniques4 ATT&CK techniques, from resource development to impact.
- 0:42Remediation3 steps now: Pause bridge withdrawal finalization on every connected chain, not only.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About $780K drained from zkLink Nova bridge.
0:06Hash validation never cleared.
0:08Attackers reused it to install forged batch roots.
0:12Build an attack contract for the Arbitrator flaw.
0:15Arm validation hash with a genuine message.
0:18Reuse same hash to run syncBatchRoot.
0:21Install forged batch root.
0:23Drain the escrows.
0:27No threat actor is attributed. Confidence: low.
0:323 indicators to hunt: 3 smart contracts.
0:384 ATT&CK techniques, from resource development to impact.
0:433 steps now: Pause bridge withdrawal finalization on every connected chain, not only.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.