Ankr Ethereum cross-chain bridge attacked, losses of about $292,000
According to monitoring by security firm Blockaid on November 9, 2026, Ankr's cross-chain bridge on Ethereum was attacked. Assets worth about $292,000 have already been transferred out through about 5 transactions, and the attack is still ongoing. The attacker submitted 5 withdrawal calls to the cross-chain bridge, using a small deposit on the Optimism network to unlock and transfer assets locked in the bridge to a new wallet address.
Subsequent monitoring showed that the attacker cited the same legitimate Optimism transaction and submitted five fake cross-chain receipts, modifying the recipient, token, and withdrawal amount. SlowMist pointed out that these five receipts all carried valid signatures from the trusted consensus signers of the cross-chain bridge, and the withdrawal function released assets without independently verifying the actual event on the source chain. The source of the unauthorized signatures is still under investigation, and it has not yet been confirmed whether the signers were compromised.
Original source:
Title: Blockaid detected an ongoing exploit on @ankr on Ethereum Publisher: Blockaid (@blockaid_) Publication date: 2026-11-09 URL: https://x.com/blockaid_/status/（相关监测帖） Nature of source: Public alert from a security monitoring organization Verification status: This reading incorporated the relevant English report and Blockaid monitoring content; verification date 2026-11-09 Supporting content: The attacker submitted five withdrawal calls, used a small Optimism deposit to unlock assets in the bridge, about $292,000 was transferred out, and the attack is still ongoing
ABAB AI Insight
Ankr mainly provides RPC node and staking infrastructure services, and its cross-chain bridge is used to transfer assets between Ethereum and other networks. This attack occurred in the early hours of November 9, 2026. The attacker used a small deposit on Optimism as a trigger condition, then initiated five withdrawals on the Ethereum side in succession, transferring the assets locked in the bridge to a new address. Blockaid initially estimated the loss at about $292,000, and some on-chain price calculations put the combined value of three major tokens at about $303,000.
SlowMist's follow-up analysis pointed out that the five fake receipts cited the same legitimate Optimism transaction, but modified the recipient, token types, and amounts, and all carried valid signatures from the trusted signer of the cross-chain bridge. This means the withdrawal logic released assets without independently verifying the actual deposit event on the source chain. Such a verification failure is a common attack surface for cross-chain bridges and is similar to the pattern in several previous bridge incidents in which the source-chain event and target-chain release did not match.
At present, public information does not show Ankr having paused the relevant contracts or issued an official statement. The bridge's pause flag still showed as not paused after the attack. Whether the attack has fully stopped, whether more assets have been transferred out, and whether the signers were compromised still depend on subsequent on-chain observation and the project's response. Once a cross-chain bridge's verification logic fails, the locked assets may be withdrawn in one shot, and the scale of losses depends on the inventory in the bridge at that time rather than the amount of any single deposit.
ABAB News · Cognitive Law
If cross-chain bridge withdrawals rely only on source-chain receipt signatures and do not independently verify the actual deposit event, fake receipts can trigger asset release.
When a small source-chain deposit is used as the trigger condition, the scale of target-chain release depends on the locked inventory in the bridge, not on the deposit amount itself.