Blockchain security firm Blockaid has detected an ongoing exploit targeting Ankr's Ethereum cross-chain bridge. In an alert published on November 9, 2026, the firm reported that an attacker had drained roughly $292,000 from the bridge through five unauthorized withdrawals — and warned that the attack was still underway when the alert was issued.

🚨Blockaid detected an ongoing exploit on @ankr on Ethereum. An attacker submitted five withdraw calls on Ankr's Ethereum cross-chain bridge, using a tiny Optimism deposit to unlock the bridge's full locked inventory to a new wallet. ~$292k drained from the bridge so far across ~5 txs. Attack still ongoing. 🧵

— Blockaid (@blockaid_) November 9, 2026

The incident raises questions about how the bridge verifies cross-chain transactions and grants asset releases. Cross-chain bridges have long ranked among the most-targeted infrastructure in the sector: they hold large pools of locked assets on behalf of two networks at once, and several of the largest exploits in crypto's history have involved them. That track record is why security firms monitor bridge contracts continuously, and why even a six-figure drain draws an immediate public alert.

One Optimism Deposit Linked to Five Withdrawals

According to Blockaid, the attacker made five withdrawal calls on Ankr's Ethereum bridge. Those transactions reportedly involved depositing a small amount of funds from Optimism, which was then used to unlock assets from the Ethereum bridge contract. The security firm estimated the total loss at approximately $292,000 across about five transactions, with the proceeds sent to a newly created withdrawal wallet.

The stolen funds were not confined to a single asset. Instead, they spanned multiple tokens, including Ankr-related liquid staking tokens and ANKR, Ankr's native cryptocurrency.

Under normal operation, a cross-chain bridge unlocks assets on one chain after a deposit is made on the originating chain. If the same transaction can be presented as evidence of authorization for another withdrawal, a single deposit could potentially be reused more than once. Blockaid's initial alert did not detail the exact technical flaw or explain how the attacker got past the bridge's authorization controls, but the pattern points to a breakdown in the verification step that precedes asset release.

Ankr Operator Wallets Swept Ahead of the Attack

On-chain activity in the lead-up to the withdrawals also shaped the incident. Blockaid reported that between 02:08 and 04:06 UTC, several Ankr operator wallets were emptied across Ethereum, Arbitrum, and Linea, with the funds deposited into a single consolidation wallet.

The attacker then transacted with that wallet to pay the fee for the relayer that submitted the transactions to the bridge. The sequence suggests the operation was carried out only after the attacker had prepared the necessary transaction infrastructure. The wallet movements alone, however, do not show how access to the operator wallets was obtained or whether their private keys were compromised.

Five Transactions Targeted the Ethereum Bridge

Blockaid identified two exploit addresses and shared an example transaction involving the exploited bridge contract. All of the withdrawals targeted the same Ethereum bridge, and the drained capital was sent to the attacker's withdrawal wallet.

The reported loss represents the amount drained at the time Blockaid issued its warning, not a final tally for the incident. That distinction is significant, because the attack was still active when the security firm raised the alarm. Ultimate losses could change depending on additional transactions, as well as price adjustments in the affected tokens.

With the exploit still open at the time of the alert, the immediate developments to watch are a revised loss tally, technical disclosure explaining how a single small deposit could unlock the bridge's inventory, and any operational response from Ankr itself. Blockaid marked its alert as the start of a thread, signalling that further detail on the incident could follow.

The incident puts cross-chain verification under scrutiny. Bridges depend on reliable communication between networks, and their security rests on correctly validating deposits, messages, and withdrawal authorizations. A failure in any part of that process can expose assets held in bridge contracts, even when the original deposit itself is legitimate.