An ongoing attack on zkLink's cross-chain bridge on Ethereum has resulted in approximately $786,000 stolen from the L1 ETH escrow and ERC20 bridge contracts. The attacker exploited a public relayer to inject a forged batch root on Ethereum, enabling finalized withdrawals of ETH and ERC20 tokens from zkLink Nova's L1 escrow contract to an attacker-controlled address. Blockaid monitoring detected the breach as it unfolded. The attack remains active at the time of reporting, with potential for additional losses.