Ankr\u2019s Ethereum cross-chain bridge has suffered an exploit involving five unauthorized withdrawals that drained more than $303,000 in crypto assets on Nov. 9, raising questions about the bridge\u2019s transaction verification process.<\/p>\n
\n Summary<\/span>\n <\/p>\n <\/p>\n Blockchain security firm Blockaid identified the attack on Monday, reporting that an attacker used a small deposit on Optimism to withdraw assets locked in Ankr\u2019s Ethereum bridge. Its initial estimate placed the losses at approximately $292,000 across five transactions, although subsequent analysis of the withdrawn tokens put their combined value above $303,000.<\/p>\n \ud83d\udea8Blockaid detected an ongoing exploit on @ankr<\/a> on Ethereum. \u2014 Blockaid (@blockaid_) November 9, 2026<\/a><\/p><\/blockquote>\n<\/div>\n<\/figure>\n The firm described the incident as an \u201congoing exploit,\u201d warning that the attacker had moved the bridge\u2019s assets into a new wallet. On-chain monitoring account Onchain Lens separately flagged<\/a> the withdrawals, reporting a similar initial loss estimate.<\/p>\n The attack took place between 3:09 a.m. and 3:12 a.m. Eastern Time, with five successful withdrawals sending different tokens to the same destination wallet. The transactions involved Ankr\u2019s liquid staking assets alongside its native ANKR token.<\/p>\n Transaction records showed that the attacker withdrew approximately 82.91 ankrETH worth $216,370, making it the largest component of the reported losses. Another withdrawal removed 515,206 ankrPOL tokens valued at $56,372, while approximately 7.98 million ANKR tokens accounted for $30,857.<\/p>\n Two other assets, 5,372.25 aMATICb and 0.8196 aETHb, were transferred during the attack. Their values were not included in the $303,600 estimate because Etherscan did not display prices for either token at the time of the assessment.<\/p>\n The total therefore represents the estimated value of three priced assets, not the amount the attacker has necessarily converted into other cryptocurrencies or cash. The five withdrawals nevertheless removed the bridge\u2019s listed token holdings from the affected Ethereum contract.<\/p>\n At 3:49 a.m. Eastern Time, the bridge\u2019s transaction history showed no further activity following the suspicious withdrawals. Its public pause flag still displayed false, leaving it unclear whether Ankr had taken additional measures to stop further unauthorized transactions.<\/p>\n The reported exploit centered on a deposit originally made through Optimism on Nov. 3. According to the transaction analysis, the deposit involved just 0.0044024803 ankrETH and had already been redeemed on Ethereum that same day.<\/p>\n However, the attacker reportedly referenced the same deposit when submitting five new withdrawal requests on Nov. 9. Each request contained modified receipt information identifying a different recipient, larger withdrawal amounts, and different tokens from the original transfer.<\/p>\n Ankr\u2019s cross-chain bridge normally allows users to move supported liquid staking assets between blockchain networks. A user deposits tokens on the originating network before submitting the transaction for verification through Ankr\u2019s backend, which provides the authorization needed to release assets on the receiving network.<\/p>\n Under this arrangement, a completed deposit should not authorize repeated withdrawals for different assets or amounts. The reported transactions nevertheless passed the bridge\u2019s authorization checks, allowing the attacker to withdraw tokens from the Ethereum contract.<\/p>\n The deployed bridge implementation requires approval from a designated signer before processing withdrawals. Although the five transactions were accepted, the available records do not establish how the attacker obtained valid authorization or whether the weakness involved the signing process, receipt validation, or another component.<\/p>\n The incident has left questions about the extent of the breach, particularly whether the affected contracts share infrastructure with Ankr\u2019s other products. The company operates liquid staking services and blockchain infrastructure products, including remote procedure call (RPC) services used by applications to communicate with blockchain networks.<\/p>\n At the time of reporting, there was no confirmation that the exploit had compromised Ankr\u2019s RPC infrastructure or users\u2019 personal wallets. The reported withdrawals concerned assets held in the affected Ethereum bridge contract, although the company had not publicly established the full scope of the incident.<\/p>\n crypto.news reached out to Ankr for comments but the company had not responded by press time.<\/p>\n Ankr previously faced a separate security incident involving its liquid staking infrastructure. In August, a vulnerability in its ankrFLOW contract allowed an attacker to create millions of unbacked tokens, resulting in approximately $410,000<\/a> in losses from MORE Markets, as crypto.news reported.<\/p>\n Other bridge operators have faced problems with transaction authorization this year. In October, Cysic suspended its bridge<\/a> after an attacker reportedly exploited processing weaknesses to create 10 million unauthorized CYS tokens on BNB Smart Chain.<\/p>\n\n
\n
An attacker submitted five withdraw calls on Ankr\u2019s Ethereum cross-chain bridge, using a tiny Optimism deposit to unlock the bridge\u2019s full locked inventory to a new wallet.
~$292k drained from the bridge so far across\u2026<\/p>\nAnkr bridge exploit drains five different tokens<\/strong><\/h2>\n
![\"Source:](\"https:\/\/media.crypto.news\/2026\/11\/image-54-1024x229.webp\")
How the Ankr Ethereum bridge attack worked<\/strong><\/h2>\n
Ankr has yet to respond to questions about affected users<\/strong><\/h2>\n