The attack is still ongoing, and zkLink is willing to offer a 20% white-hat bounty

Odaily reports: According to zkLink monitoring, the attack on the Arbitrator contracts of zkLink Nova on Ethereum and Optimism is still ongoing, and the technical team is urgently responding to contain the losses. zkLink has called on the attackers to stop further exploiting the omnichain contracts and return the affected funds, stating that if the attackers cooperate in returning the funds, a 20% white-hat bounty will be offered and no further action will be pursued. Previously, SlowMist issued a security alert stating that the related losses amounted to approximately $783,100. The root cause of the attack points to the Arbitrator contract's claimMessage failing to clear the temporary finalizeMessageHash and failing to require each call to go through a new authentication callback; attackers can exploit the publicly callable authorized SyncL2TxHashRelayer to inject a forged batch root and withdraw assets.