Liquid

Optimism

Safe

Ankr

<p><strong>Blockchain security firm SlowMist published its analysis of a cross-chain bridge exploit on November 9, 2026, reporting that Ankr’s bridge lost approximately $304,500 to an attacker who submitted five forged withdrawal receipts, all of which carried valid signatures from the bridge’s own trusted consensus signer.</strong></p>
<p>The figure surpassed an earlier <a href="https://www.coininsider.org/news/ankr-bridge-drained-as-five-forged-withdrawals-pass-signature-checks/" rel="noopener noreferrer nofollow">$292,000 estimate from security firm Blockaid</a>, with SlowMist’s later analysis incorporating more complete pricing data. The gap between the two estimates underscores how fast post-mortem figures can shift in the hours after an exploit. For related coverage, see <a href="https://www.theccpress.com/rialto-protocol/" rel="noopener noreferrer nofollow">Rialto Protocol Overview: Reported Features, Referral Terms and Airdrop Risks</a>.</p>
<h2 id="slowmist-says-ankr-lost-304-500">SlowMist Says Ankr Lost $304,500</h2>
<p>SlowMist published its findings at approximately 09:14 UTC, flagging the Ankr cross-chain bridge on Ethereum as the target. The five forged receipts all traced back to a single legitimate Optimism transaction, originally involving just 0.0044024803 ankrETH deposited on November 3, 2026, a transaction that had already been redeemed six days before the attack. Context on this theme: <a href="https://www.theccpress.com/top-crypto-prop-trading-firms-in-2026/" rel="noopener noreferrer nofollow">Top Crypto Prop Trading Firms in 2026</a>.</p>
<figure style="margin:24px 0;padding:24px;border:1px solid #d9e1e8;border-left:5px solid #1b6ca8;background:#f7fafc;border-radius:4px;text-align:center;font-family:Arial,Helvetica,sans-serif;">
 <div style="margin:0 0 8px;color:#3e5568;font-size:12px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;">
  Estimated bridge loss
 </div>
 <div style="margin:0;color:#102a43;font-size:42px;font-weight:800;line-height:1.1;">
  $304,500
 </div>
 <figcaption style="margin-top:10px;color:#526b7a;font-size:14px;line-height:1.45;">
  SlowMist’s reported total loss in the Ankr bridge exploit.
 </figcaption>
</figure>
<p>SlowMist identified the receiving address as the attacker and reported total withdrawals valued at approximately $304,500 from a recycled, already-redeemed transaction.</p>
<p>The assets drained across the five withdrawals included approximately 82.91 ankrETH, 515,206 Polygon staking tokens, 7.98 million ANKR tokens, 5,372.25 aPOLb, and 0.8196 aETHb, according to CoinInsider’s breakdown of the attack. All five withdrawals were directed to the same receiving address.</p>
<p>The entire sequence ran from 08:09:35 to 08:11:59 UTC, a window of roughly two minutes and twenty-four seconds. Bridge withdrawals were not paused until 09:51:47 UTC, approximately 100 minutes after the first unauthorized withdrawal cleared.</p>
<h2 id="five-forged-submissions-cited-in-the-report">Five Forged Submissions Cited in the Report</h2>
<p>SlowMist alleged that five forged cross-chain receipts passed the bridge’s signature verification. According to SlowMist, each receipt carried what appeared to be a valid signature from the bridge’s trusted consensus signer, allowing the bridge’s <code>withdraw()</code> function to release assets without independently confirming that the underlying Optimism transactions had actually occurred.</p>
<figure style="margin:24px 0;padding:24px;border:1px solid #d9e1e8;border-left:5px solid #d97706;background:#fffaf0;border-radius:4px;text-align:center;font-family:Arial,Helvetica,sans-serif;">
 <div style="margin:0 0 8px;color:#7c4a03;font-size:12px;font-weight:700;letter-spacing:0.08em;text-transform:uppercase;">
  Forged withdrawal receipts
 </div>
 <div style="margin:0;color:#5c3500;font-size:42px;font-weight:800;line-height:1.1;">
  5
 </div>
 <figcaption style="margin-top:10px;color:#765d36;font-size:14px;line-height:1.45;">
  SlowMist alleged that five altered receipts bypassed replay protection and enabled the withdrawals.
 </figcaption>
</figure>
<p>According to SlowMist’s findings, the bridge’s replay protection only blocked identical proof submissions. SlowMist alleged that altered receipt contents, including the recipient address, token type, and amount, generated five distinct proof hashes that cleared without triggering the duplicate-submission guard, as also reported by <a href="https://www.techflowpost.com/en-US/newsletter/143691" rel="noopener noreferrer nofollow">TechFlowPost</a>.</p>
<p>This is not a novel attack class. The design flaw, trusting a consensus signer’s signature without verifying the source-chain event, has appeared in other cross-chain bridge incidents. SlowMist has previously documented similar signing vulnerabilities, including in its <a href="https://www.theccpress.com/slowmist-flashloopadapter-flaw-safe-wallets-collateral-drain/" rel="noopener noreferrer nofollow">analysis of the FlashLoopAdapter flaw that drained two Safe wallets</a> and in its <a href="https://www.theccpress.com/slowmist-liquid-network-exploit-3998-l-btc/" rel="noopener noreferrer nofollow">report on the Liquid Network exploit that minted 3,998 L-BTC</a>.</p>
<p>As of SlowMist’s publication time, the source of the unauthorized signatures remained under investigation. Whether the bridge’s consensus signer keys were compromised from outside or whether the signing came from another vector had not been confirmed. SlowMist flagged this as an open question, and Ankr had not released an official post-mortem at time of reporting.</p>
<h2 id="what-the-report-means-for-ankr-users-and-security-teams">What the Report Means for Ankr Users and Security Teams</h2>
<p>The ANKR token was trading at <a href="https://www.coingecko.com/en/coins/ankr" rel="noopener noreferrer nofollow">$0.003942</a> at the time of the exploit, with a market cap of approximately $39.42 million and 24-hour trading volume around $6.4 million, according to CoinGecko data. The token posted a modest 1.05% gain on the day, though that figure predates the full market digestion of the incident.</p>
<p>The broader crypto market was sitting in Fear territory, with the <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Fear &amp; Greed Index</a> at 29 out of 100 on the day of the exploit. The Ankr incident was drawing coverage across multiple outlets by mid-morning UTC.</p>
<p>Ankr has not confirmed a recovery plan. With bridge withdrawals paused and the signing source still under investigation, the question hanging over the project is whether this was an external key compromise, an insider event, or something else entirely. The answer will determine whether users can trust a resumed bridge, and SlowMist’s investigation appears to be ongoing.</p>
<div class="site-qc-box" style="border:1px solid #3a3a3a;border-left:4px solid #3b82f6;padding:14px 16px;margin:28px 0 12px;font-size:14px;line-height:1.5;">
 <p style="margin:0 0 12px;font-size:16px;"><strong>Editorial credits</strong></p>
 <div style="display:flex;gap:12px;align-items:flex-start;margin:0 0 12px;"><span style="flex:0 0 44px;width:44px;height:44px;border-radius:50%;background:#1f2937;color:#e5e7eb;display:inline-flex;align-items:center;justify-content:center;font-weight:700;font-size:15px;">LM</span>
  <div>
   <div><a href="https://www.theccpress.com/lucas-mercer/" rel="noopener noreferrer nofollow"><strong>Lucas Mercer</strong></a>
   </div>
   <div style="font-size:13px;opacity:.8;">
    Duty editor · TheCCPress
   </div>
   <div style="font-size:13px;margin-top:2px;">
    Monitors published articles around the clock and can correct or withdraw them.
   </div>
  </div>
 </div>
 <p style="margin:4px 0 8px;">Checked by <a href="https://www.theccpress.com/how-we-review/" rel="noopener noreferrer nofollow">TheCCPress QC Team</a> before publishing on November 9, 2026 for cause-and-effect claims, counter-evidence, labeling, headline accuracy, factual consistency, metadata and authorship claims: our AI review system checks every article before it goes live, and our duty editor monitors it after publication. <a href="https://www.theccpress.com/contact/" rel="noopener noreferrer nofollow">Report an error</a>.</p>
 <p style="margin:0;font-size:12px;opacity:.8;">TheCCPress uses AI for research, drafting and review. Our editorial team is responsible for every article and corrects or withdraws articles when needed. <a href="https://www.theccpress.com/how-we-review/" rel="noopener noreferrer nofollow">How we review</a>.</p>
</div>
<p style="font-size:13px;color:#888;border-top:1px solid #333;padding-top:12px;margin-top:30px;">Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p>The article <a href="https://www.theccpress.com/?p=49955" rel="noopener noreferrer nofollow">SlowMist Reports $304,500 Ankr Loss From Five Allegedly Forged Submissions</a> first featured on <a href="https://theccpress.com/" rel="noopener noreferrer nofollow">theccpress.com</a>.</p>

SlowMist Reports $304,500 Ankr Loss From Five Allegedly Forged Submissions

Table of Contents

Cryptocurrency Press

Other articles published on Nov 9, 2026

Join our free newsletter for daily crypto updates!