Ankr bridge exploit drains more than $303,000 in assets before shutdown
Key Facts
Block Stream Media, citing an alert from Blockaid, reported on Nov. 9 that it had detected an exploit of Ankr’s cross-chain bridge on Ethereum involving five withdrawal requests that the company said were used to access bridge assets via a small deposit on Optimism. The initial alert estimated the withdrawals at about $292,000 across five transactions, before a later analysis of the withdrawn token values raised the estimate to more than $303,000. A subsequent report said the bridge contract was paused the same day, limiting the accuracy of describing the incident as an ongoing exploit after the shutdown. Blockaid said the attacker "submitted five withdrawal requests on Ankr’s cross-chain bridge on Ethereum." The report did not identify a specific software flaw behind the incident.
The withdrawals took place between 3:09 and 3:12 a.m. Eastern time, sending five different assets to a single receiving wallet. The largest amounts included about 82.91 ankrETH, valued at $216,370, and 515,206 ankrPOL worth $56,372. About 7.98 million ANKR was also withdrawn, with an estimated value of $30,857. According to the estimates in the report, these tokens accounted for most of the priced value of the withdrawals. The timeline indicated that the five transactions were carried out in about three minutes.
A further 5,372.25 aMATICb and 0.8196 aETHb were also transferred during the attack. The value of these two assets was not included in the $303,600 estimate because Etherscan did not display a price for either when the estimate was prepared. The reported figure therefore excludes the value of the two unpriced tokens, while another update put the total withdrawn assets at more than $303,000. The published figures show a difference between Blockaid’s initial estimate, later token valuations and an independent estimate cited by SlowMist. SlowMist estimated the loss at about $304,500.
According to SlowMist’s report, the five receipts were based on a single legitimate transaction on Optimism, with the recipient, token and amounts changed in each receipt. The company said trusted signatures allowed the withdraw() function to release assets without matching the receipts against events on the source chain. Its report described the receipts as "forged cross-chain receipts pointing to one legitimate Optimism transaction." Block Stream Media addressed the authorization aspect, noting that the bridge contract requires approval from a designated signer for withdrawals. But available records, the report said, do not establish how the attacker obtained accepted authorization or whether the flaw lay in the signature or receipt verification.
SlowMist said the source of the unauthorized signatures had not been determined, noting that the receipts carried signatures valid under the bridge’s trusted consensus signature. That leaves open the question of how those signatures were issued or used to pass the withdrawals, without the report establishing a definitive cause of the incident. When the bridge log was checked at 3:49 a.m. Eastern time, no further activity appeared, although the public pause indicator was still shown as inactive in that update. The subsequent report said the bridge contract was paused on Nov. 9, without giving a more precise time in the available account. The published information does not establish that additional losses continued after the contract was paused.
Ankr had not responded to the report’s inquiries about which services were affected, bridge security and whether users would be compensated. The report also did not confirm that the company’s RPC infrastructure or users’ personal wallets had been compromised. The confirmed scope of damage was therefore limited to the assets the reports listed in withdrawals from the bridge contract, while questions about the investigation, authorization and compensation remained unanswered in published accounts. The report included no confirmation that assets had been recovered and no announcement of further steps by the company. Available information about the scope of impact remains tied to what was reported on Nov. 9.