zkLink reports emergency containment after Nova bridge exploit; researchers trace a second wave

The vendor acknowledgment establishes a real exploit, supporting L4. SlowMist attributes the failure to Arbitrator.claimMessage retaining transient message state without a fresh authenticated callback. That is a research assessment, not a published vendor post-mortem. Parapet Labs now supplies a readable original technical report: a publicly callable whitelisted relayer, a privileged call to a caller-selected target and reusable transient validation state combined to allow forged withdrawal roots without privileged access.

SlowMist estimates about $783,100. This is an early researcher estimate, unverified outside that investigation, not a final vendor-confirmed loss, a current reserve balance or a reimbursement figure. The official notice names Ethereum and Optimism but does not quantify loss separately on either chain.

Parapet estimates about $743,000 for the original Ethereum drain at exploit-time prices, then reports a separate second wave taking about 24.76 ETH plus token inventories on Optimism, Base, Blast and Mantle. Do not add these unlike units to SlowMist’s earlier estimate or call any one figure the final total. Parapet assesses Linea’s different executor as outside this specific vector; its historical balance and exposure table is not a current reserve audit.

The vendor’s October 29 follow-up reports suspended Nova block production and emergency-patched affected contracts. Its visible public embed cuts off during the withdrawal-related measure, so the complete withdrawal scope and later conditions are not established here. Parapet’s assessment that contracts remained unpatched is dated around 10:00 UTC that day; it does not test the vendor’s subsequent patch claim. Neither a safe reopening time nor recovery payments are verified. The precaution against adding bridge exposure is editorial containment advice derived from the vendor’s ongoing-exploit warning, not a claim that the project has ordered a specific withdrawal procedure.