Ankr's Ethereum cross chain bridge suffered an exploit that allowed an attacker to withdraw approximately $292,000 in crypto assets, according to blockchain security firm Blockaid. The incident involved five fraudulent withdrawal receipts created from a previously valid Optimism transaction.

By modifying transaction details while retaining valid signatures, the attacker bypassed the bridge's verification process and extracted several Ankr related tokens. The attack raised immediate concerns about the bridge's security and the possibility of further unauthorized withdrawals.

Blockaid Detects Five Unauthorized Withdrawals

Blockaid identified the Ankr bridge exploit and reported that the attacker had executed five withdrawal calls on Ethereum. The transactions relied on a legitimate Optimism deposit of just 0.0044 ankrETH, which was reused to create fraudulent withdrawal receipts.

Rather than submitting separate genuine deposits, the attacker altered details within the original transaction receipts, including destination addresses and withdrawal amounts. The receipts retained valid signatures, allowing the bridge to accept them as legitimate requests.

This manipulation enabled withdrawals that were not supported by corresponding deposits on the source chain. Blockaid initially estimated the losses at approximately $292,000 and described the attack as ongoing.

🚨Blockaid detected an ongoing exploit on @ankr on Ethereum. An attacker submitted five withdraw calls on Ankr’s Ethereum cross-chain bridge, using a tiny Optimism deposit to unlock the bridge’s full locked inventory to a new wallet. ~$292k drained from the bridge so far across ~5 txs. Attack still ongoing. 🧵

— Blockaid (@blockaid_) November 9, 2026

Ankr Bridge Loses Multiple Tokens Worth Over $300,000

The attacker withdrew five different assets from the Ethereum bridge, including liquid staking tokens and ANKR. The stolen assets included 83 ankrETH valued at approximately $192,000, 515,200 ankrPOL worth around $56,000, and 8 million ANKR tokens valued at approximately $30,700.

The withdrawals also involved 5,372 aMATICb tokens and additional aETHb. The Defiant estimated the total loss at $303,600, while other security reports placed the damage between $286,000 and $304,500.

Most of the stolen assets were subsequently exchanged for approximately 103 ETH, moving the funds into a different asset.

🚨 SlowMist TI Alert 🚨

💸 @ankr Loss: ~$304.5k

🔍 Root Cause: The attacker submitted five forged cross-chain receipts referencing the same legitimate Optimism transaction, altering the recipient, token, and withdrawal amounts. All five receipts carried valid signatures from the bridge's trusted consensus signer, allowing withdraw() to release assets without independently verifying the receipts against the actual source-chain events.

⚠️ The origin of the unauthorized signatures remains under investigation. Signer compromise has not been confirmed.

📌 Attacker (Tx Sender): 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703
📌 Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6
📌 Vulnerable Contract: 0xc437DF90B37C1dB6657339E31BfE54627f0e7181

Powered by https://t.co/Mz5jOnx997
Attack Tx:
https://t.co/dU9j2cO3dI
https://t.co/ALkBI5RbiA
https://t.co/i2iFAEe73X
https://t.co/ZPCecX3FkP
https://t.co/LyaWqIvutJ

Reused Source Tx:
https://t.co/ATrjujtYHV

— SlowMist (@SlowMist_Team) November 9, 2026

Ankr Yet to Respond as Users Face Security Concerns

Ankr has not issued a public response addressing the exploit, the source of the forged signatures, or possible compensation for affected users. The incident also leaves questions about whether the bridge remains vulnerable to additional unauthorized withdrawals.

Users interacting with Ankr's bridge should closely monitor their wallets and avoid further transactions until the security situation becomes clearer. Blockaid's initial alert specifically described the attack as ongoing, making the possibility of additional losses an immediate concern.

If you find any issues in this article or notice missing information, please feel free to reach out at team@etherworld.co for clarifications or updates.

To promote your Web3 articles, events, and projects, you may reach out anytime via EtherWorld PR for submissions and collaboration.

Related Articles

1. Tampered Wallets Lead to $3.5M Losses
2. ICE Partners With Trade.xyz for Hyperliquid Futures
3. Canadian Teen Gets 25 Months for $13M Bitcoin Scam
4. BitMine ETH Holdings Rise as Tom Lee Targets $10K
5. Keystone Wallet Hack Raises Customer Privacy Concerns

To follow blockchain news, track Ethereum protocol progress, and read our latest stories, subscribe to our weekly today.

Join the EtherWorld & Avarch Internship Program and build your career in blockchain, content, social media, video, podcast editing, or operations. Send your resume and brief introduction to contact@etherworld.co.