Raise

Arbitrum

Ankr

Nova

Ethereum

Ankr’s Ethereum cross-chain bridge suffered an exploit on November 9, losing approximately $304,500 after an attacker submitted five fraudulent withdrawal requests using a previously completed deposit on Optimism.
Blockchain security firm <a href="https://x.com/blockaid_/status/2119712260184527262" rel="noopener noreferrer nofollow">Blockaid</a> initially identified the attack and estimated losses at $292,000. <a href="https://x.com/SlowMist_Team/status/2119720284093890615" rel="noopener noreferrer nofollow">SlowMist</a> later raised the figure to approximately $304,500, identifying forged cross-chain receipts that passed the bridge’s authorization checks despite containing manipulated transaction details.
The attacker exploited a legitimate November 3 deposit of approximately 0.0044 ankrETH on Optimism. That transfer had already been redeemed on <a href="https://cryptoadventure.com/the-beginners-guide-to-ethereum/" rel="noopener noreferrer nofollow">Ethereum</a>, but its transaction reference was reused to authorize five additional withdrawals involving different assets, recipients and amounts.
The withdrawals occurred within approximately three minutes, transferring the bridge’s available inventory of several tokens to an attacker-controlled wallet.
<h2 id="five-forged-withdrawals-drain-bridge-reserves">Five Forged Withdrawals Drain Bridge Reserves</h2>
The <a href="https://etherscan.io/address/0xc437DF90B37C1dB6657339E31BfE54627f0e7181" rel="noopener noreferrer nofollow">Ethereum transactions</a> show that the attacker extracted approximately 82.91 ankrETH, 515,206 ankrPOL and 7.98 million ANKR tokens. Two additional withdrawals removed roughly 5,372 Polygon-linked staking tokens and 0.82 aETHb.
PeckShield <a href="https://x.com/PeckShieldAlert/status/2119730625695662322" rel="noopener noreferrer nofollow">traced the stolen assets</a>, estimating the initial loss at approximately $286,000 and reporting that most of the proceeds were converted into roughly 103 ETH, worth approximately $217,000 at the time.
The varying loss estimates reflect differences in token valuations and the timing of each firm’s assessment.
SlowMist identified the central vulnerability in the bridge’s withdrawal authorization process. Although the five receipts referenced the same original Optimism transaction, each contained modified transfer details and carried a valid signature from the bridge’s trusted consensus signer.
Those signatures allowed the bridge’s <code>withdraw()</code> function to release assets without independently verifying that the claimed withdrawals matched genuine source-chain deposits.
Ankr’s <a href="https://www.ankr.com/docs/staking-for-developers/dev-details/bridge-mechanics/" rel="noopener noreferrer nofollow">bridge architecture</a> relies on a notarization process in which deposit transactions receive authorization before corresponding assets can be released on another network.
How the attacker obtained valid signatures remains unresolved. SlowMist has not confirmed whether signing credentials were compromised or whether the authorization infrastructure was manipulated.
<h2 id="earlier-operator-wallet-transfers-raise-questions">Earlier Operator Wallet Transfers Raise Questions</h2>
Blockaid also <a href="https://x.com/blockaid_/status/2119728818457821402" rel="noopener noreferrer nofollow">identified suspicious fund movements</a> involving wallets associated with Ankr’s operations across Ethereum, Arbitrum and Linea.
Several hours before the bridge withdrawals, funds from those wallets were consolidated into a separate address and subsequently used to fund the account executing the exploit.
The connection between these transfers and the unauthorized signatures remains unconfirmed. Investigators have not established whether the activity involved compromised operational credentials or another attack method.
The incident follows a separate <a href="https://cryptoadventure.com/more-markets-loses-9-3m-as-wflow-reserve-is-drained-on-flow-evm/" rel="noopener noreferrer nofollow">Ankr liquid-staking contract exploit</a> in August, when a vulnerability in ankrFLOW enabled the creation of unbacked tokens and approximately $410,000 in losses from MORE Markets.
A similar cross-chain authorization failure also affected the <a href="https://cryptoadventure.com/zklink-nova-bridge-drained-of-786k-after-forged-batch-root-exploit/" rel="noopener noreferrer nofollow">zkLink Nova bridge</a> in late October, resulting in approximately $786,000 in unauthorized withdrawals.
Ankr’s Ethereum bridge initially remained unpaused after the November 9 attack. However, subsequent on-chain records indicate that withdrawals were suspended at approximately 09:51 UTC that morning.
Ankr had not issued a public incident statement or announced a recovery plan at the time of reporting. The origin of the accepted signatures, the final financial loss and any potential reimbursement for affected users remain unconfirmed.
The post <a href="https://cryptoadventure.com/ankr-ethereum-bridge-loses-304k-in-receipt-exploit/" rel="noopener noreferrer nofollow">Ankr Ethereum Bridge Loses $304K in Receipt Exploit</a> appeared first on <a href="https://cryptoadventure.com" rel="noopener noreferrer nofollow">Crypto Adventure</a>.

Ankr Ethereum Bridge Loses $304K in Receipt Exploit

Table of Contents

Crypto Adventure

Other articles published on Nov 12, 2026

Join our free newsletter for daily crypto updates!