Ankr's Ethereum cross-chain bridge lost approximately $304,500 on November 9 after an attacker submitted five fraudulent withdrawal requests built on a deposit that had already been completed on Optimism.

Blockchain security firm Blockaid first identified the attack and put initial losses at $292,000. SlowMist subsequently raised the estimate to roughly $304,500, attributing the theft to forged cross-chain receipts that passed the bridge's authorization checks despite carrying manipulated transaction details.

The attacker repurposed a legitimate November 3 deposit of approximately 0.0044 ankrETH on Optimism. Although that transfer had already been redeemed on Ethereum, its transaction reference was reused to authorize five additional withdrawals involving different assets, recipients, and amounts. The five withdrawals were executed within roughly three minutes, moving the bridge's available inventory of several tokens to an attacker-controlled wallet. The reuse pattern points to a structural exposure in bridge design: when withdrawals are approved on the strength of a receipt alone, a single settled deposit reference can support multiple claims unless destination-side checks confirm each request against the source chain's records.

Five Forged Withdrawals Drain Bridge Reserves

On-chain records show the attacker extracted approximately 82.91 ankrETH, 515,206 ankrPOL, and 7.98 million ANKR tokens. Two further withdrawals removed roughly 5,372 Polygon-linked staking tokens and 0.82 aETHb.

PeckShield traced the stolen assets, estimating the initial loss at about $286,000 and reporting that most of the proceeds were converted into roughly 103 ETH, worth approximately $217,000 at the time. The differing loss estimates reflect variations in token valuations and the timing of each firm's assessment.

SlowMist identified the central vulnerability in the bridge's withdrawal authorization process. Although all five receipts referenced the same original Optimism transaction, each contained altered transfer details and carried a valid signature from the bridge's trusted consensus signer. Those signatures allowed the bridge's withdraw() function to release assets without independently verifying that the claimed withdrawals matched genuine source-chain deposits.

Ankr's bridge architecture depends on a notarization process in which deposit transactions receive authorization before the corresponding assets can be released on another network. That reliance on a trusted signing layer is widespread across cross-chain infrastructure, and it is why the rigor of destination-side verification — rather than the size of individual deposits — determines how much value is exposed to any single approved withdrawal.

How the attacker obtained valid signatures remains unresolved. SlowMist has not confirmed whether signing credentials were compromised or whether the authorization infrastructure was manipulated.

Earlier Operator Wallet Transfers Raise Questions

Blockaid also flagged suspicious fund movements involving wallets associated with Ankr's operations across Ethereum, Arbitrum, and Linea. Several hours before the bridge withdrawals, funds from those wallets were consolidated into a separate address and later used to fund the account that executed the exploit.

The connection between these transfers and the unauthorized signatures remains unconfirmed, and investigators have not established whether the activity involved compromised operational credentials or another attack method.

Prior Incidents and Bridge Status

The exploit follows a separate Ankr liquid-staking contract incident in August, when a vulnerability in ankrFLOW enabled the creation of unbacked tokens and approximately $410,000 in losses from MORE Markets. A similar cross-chain authorization failure also affected the zkLink Nova bridge in late October, resulting in approximately $786,000 in unauthorized withdrawals.

Ankr's Ethereum bridge initially remained unpaused after the November 9 attack, though subsequent on-chain records indicate withdrawals were suspended at approximately 09:51 UTC that morning. Ankr had not issued a public incident statement or announced a recovery plan at the time of reporting. The origin of the accepted signatures, the final financial loss, and any potential reimbursement for affected users remain unconfirmed. With withdrawals suspended and no official account of the accepted signatures yet available, the near-term markers to watch are Ankr's incident statement and any recovery or reimbursement plan, how long the withdrawal suspension remains in force, and updated tracing or loss figures from the security firms tracking the roughly 103 ETH in converted proceeds.

Source: Crypto Adventure