Ankr Ethereum bridge drained of about $304.5K via five forged cross-chain receipts carrying valid signer signatures

Summary

On 9 November 2026 an attacker submitted five forged cross-chain receipts to Ankr's Ethereum bridge. Per SlowMist, all five referenced the same legitimate Optimism transaction but altered the recipient, token and withdrawal amounts. Each carried a valid signature from the bridge's trusted consensus signer, so withdraw() released assets without independently verifying the receipts against source-chain events. SlowMist puts the loss at about $304.5K; Blockaid's earlier alert, as reported by media, estimated about $292K.

Affected

• Ankr cross-chain bridge contract on Ethereum (0xc437DF90B37C1dB6657339E31BfE54627f0e7181, per SlowMist; listed here for identification only, not as an indicator)
• Withdrawn assets reported in media coverage include ankrETH, ANKR, aPOLb, aETHb and Polygon staking tokens
• No fix available at time of publication; bridge withdrawals were reported paused

Impact

Exploitation in the wild is confirmed: five attack transactions from the same sender succeeded on Ethereum mainnet. SlowMist states that the origin of the unauthorized signatures remains under investigation and that signer compromise has not been confirmed. Ankr has not published a post-mortem at the time of publication.

Recommended actions

• Do not interact with the Ankr bridge until Ankr confirms it is safe to resume.
• Exchanges, bridges and DEX operators: monitor and flag funds from the attacker and recipient addresses below.
• Bridge operators: do not rely on a single signer's attestation; verify receipts against source-chain events and reject replays of an already-processed source transaction.

Source & attribution

This 0xCERT advisory summarises a disclosure by SlowMist (https://x.com/SlowMist_Team/status/2119720284093890615), with the initial alert by Blockaid as reported by CoinInsider (https://www.coininsider.org/news/ankr-bridge-drained-as-five-forged-withdrawals-pass-signature-checks/). Indicators are copied from SlowMist's alert; 0xCERT checked that the listed attack transactions were sent by the listed attacker to the listed bridge contract. Details may change; refer to the original source for the authoritative record.