Ankr’s Ethereum cross-chain bridge has suffered an exploit involving five unauthorized withdrawals that drained more than $303,000 in crypto assets on Nov. 9, raising questions about the bridge’s transaction verification process.
Summary
- Ankr’s Ethereum bridge lost over $303,000 after an attacker executed five unauthorized withdrawals on Monday.
- The attacker reportedly reused an Optimism deposit to withdraw five different tokens from Ethereum’s bridge.
- Blockaid flagged the exploit as ongoing, with the bridge’s public pause flag initially remaining false.
- Ankr had not responded to questions about affected services, bridge security, or possible user reimbursements.
Blockchain security firm Blockaid identified the attack on Monday, reporting that an attacker used a small deposit on Optimism to withdraw assets locked in Ankr’s Ethereum bridge. Its initial estimate placed the losses at approximately $292,000 across five transactions, although subsequent analysis of the withdrawn tokens put their combined value above $303,000.
The firm described the incident as an “ongoing exploit,” warning that the attacker had moved the bridge’s assets into a new wallet. On-chain monitoring account Onchain Lens separately flagged the withdrawals, reporting a similar initial loss estimate.
Ankr bridge exploit drains five different tokens
The attack took place between 3:09 a.m. and 3:12 a.m. Eastern Time, with five successful withdrawals sending different tokens to the same destination wallet. The transactions involved Ankr’s liquid staking assets alongside its native ANKR token.
Transaction records showed that the attacker withdrew approximately 82.91 ankrETH worth $216,370, making it the largest component of the reported losses. Another withdrawal removed 515,206 ankrPOL tokens valued at $56,372, while approximately 7.98 million ANKR tokens accounted for $30,857.
Two other assets, 5,372.25 aMATICb and 0.8196 aETHb, were transferred during the attack. Their values were not included in the $303,600 estimate because Etherscan did not display prices for either token at the time of the assessment.
The total therefore represents the estimated value of three priced assets, not the amount the attacker has necessarily converted into other cryptocurrencies or cash. The five withdrawals nevertheless removed the bridge’s listed token holdings from the affected Ethereum contract.
At 3:49 a.m. Eastern Time, the bridge’s transaction history showed no further activity following the suspicious withdrawals. Its public pause flag still displayed false, leaving it unclear whether Ankr had taken additional measures to stop further unauthorized transactions.
How the Ankr Ethereum bridge attack worked
The reported exploit centered on a deposit originally made through Optimism on Nov. 3. According to the transaction analysis, the deposit involved just 0.0044024803 ankrETH and had already been redeemed on Ethereum that same day.
However, the attacker reportedly referenced the same deposit when submitting five new withdrawal requests on Nov. 9. Each request contained modified receipt information identifying a different recipient, larger withdrawal amounts, and different tokens from the original transfer.
Ankr’s cross-chain bridge normally allows users to move supported liquid staking assets between blockchain networks. A user deposits tokens on the originating network before submitting the transaction for verification through Ankr’s backend, which provides the authorization needed to release assets on the receiving network.
Under this arrangement, a completed deposit should not authorize repeated withdrawals for different assets or amounts. The reported transactions nevertheless passed the bridge’s authorization checks, allowing the attacker to withdraw tokens from the Ethereum contract.
The deployed bridge implementation requires approval from a designated signer before processing withdrawals. Although the five transactions were accepted, the available records do not establish how the attacker obtained valid authorization or whether the weakness involved the signing process, receipt validation, or another component.
Ankr has yet to respond to questions about affected users
The incident has left questions about the extent of the breach, particularly whether the affected contracts share infrastructure with Ankr’s other products. The company operates liquid staking services and blockchain infrastructure products, including remote procedure call (RPC) services used by applications to communicate with blockchain networks.
At the time of reporting, there was no confirmation that the exploit had compromised Ankr’s RPC infrastructure or users’ personal wallets. The reported withdrawals concerned assets held in the affected Ethereum bridge contract, although the company had not publicly established the full scope of the incident.
crypto.news reached out to Ankr for comments but the company had not responded by press time.
Ankr previously faced a separate security incident involving its liquid staking infrastructure. In August, a vulnerability in its ankrFLOW contract allowed an attacker to create millions of unbacked tokens, resulting in approximately $410,000 in losses from MORE Markets, as crypto.news reported.
Other bridge operators have faced problems with transaction authorization this year. In October, Cysic suspended its bridge after an attacker reportedly exploited processing weaknesses to create 10 million unauthorized CYS tokens on BNB Smart Chain.
In August, an XRPL bridge operator reported losing 198,715.88 XRP after attackers exploited faulty deposit detection logic. The operator halted the affected bridge and filed a complaint with the FBI while investigating the unauthorized withdrawals.
