Ankr Ethereum Bridge Loses $304K in Receipt Exploit

Ankr’s Ethereum cross-chain bridge suffered an exploit on November 9, losing approximately $304,500 after an attacker submitted five fraudulent withdrawal requests using a previously completed deposit on Optimism.

Blockchain security firm Blockaid initially identified the attack and estimated losses at $292,000. SlowMist later raised the figure to approximately $304,500, identifying forged cross-chain receipts that passed the bridge’s authorization checks despite containing manipulated transaction details.

The attacker exploited a legitimate November 3 deposit of approximately 0.0044 ankrETH on Optimism. That transfer had already been redeemed on Ethereum, but its transaction reference was reused to authorize five additional withdrawals involving different assets, recipients and amounts.

The withdrawals occurred within approximately three minutes, transferring the bridge’s available inventory of several tokens to an attacker-controlled wallet.

Five Forged Withdrawals Drain Bridge Reserves

The Ethereum transactions show that the attacker extracted approximately 82.91 ankrETH, 515,206 ankrPOL and 7.98 million ANKR tokens. Two additional withdrawals removed roughly 5,372 Polygon-linked staking tokens and 0.82 aETHb.

PeckShield traced the stolen assets, estimating the initial loss at approximately $286,000 and reporting that most of the proceeds were converted into roughly 103 ETH, worth approximately $217,000 at the time.

The varying loss estimates reflect differences in token valuations and the timing of each firm’s assessment.

SlowMist identified the central vulnerability in the bridge’s withdrawal authorization process. Although the five receipts referenced the same original Optimism transaction, each contained modified transfer details and carried a valid signature from the bridge’s trusted consensus signer.

Those signatures allowed the bridge’s withdraw() function to release assets without independently verifying that the claimed withdrawals matched genuine source-chain deposits.

Ankr’s bridge architecture relies on a notarization process in which deposit transactions receive authorization before corresponding assets can be released on another network.

How the attacker obtained valid signatures remains unresolved. SlowMist has not confirmed whether signing credentials were compromised or whether the authorization infrastructure was manipulated.

Earlier Operator Wallet Transfers Raise Questions

Blockaid also identified suspicious fund movements involving wallets associated with Ankr’s operations across Ethereum, Arbitrum and Linea.

Several hours before the bridge withdrawals, funds from those wallets were consolidated into a separate address and subsequently used to fund the account executing the exploit.

The connection between these transfers and the unauthorized signatures remains unconfirmed. Investigators have not established whether the activity involved compromised operational credentials or another attack method.

The incident follows a separate Ankr liquid-staking contract exploit in August, when a vulnerability in ankrFLOW enabled the creation of unbacked tokens and approximately $410,000 in losses from MORE Markets.

A similar cross-chain authorization failure also affected the zkLink Nova bridge in late October, resulting in approximately $786,000 in unauthorized withdrawals.

Ankr’s Ethereum bridge initially remained unpaused after the November 9 attack. However, subsequent on-chain records indicate that withdrawals were suspended at approximately 09:51 UTC that morning.

Ankr had not issued a public incident statement or announced a recovery plan at the time of reporting. The origin of the accepted signatures, the final financial loss and any potential reimbursement for affected users remain unconfirmed.

The post Ankr Ethereum Bridge Loses $304K in Receipt Exploit appeared first on Crypto Adventure.