-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0328
============================================================

Advisory-ID:  0xCERT-2026-0328
Severity:     Medium
Published:    2026-11-09T09:14:32.000Z
Updated:      2026-11-09T16:43:32.086Z
Chains:       Ethereum, Optimism
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0328

Title: Ankr Ethereum bridge drained of about $304.5K via five forged cross-chain receipts carrying valid signer signatures

Summary
- -------
An attacker withdrew about $304.5K in ankrETH, ANKR, aPOLb and other tokens from Ankr's Ethereum bridge using five forged receipts that reused one legitimate Optimism transaction. Withdrawals were paused; how the attacker obtained valid signer signatures is still under investigation.

Details
- -------
Summary
On 9 November 2026 an attacker submitted five forged cross-chain receipts to Ankr's Ethereum bridge. Per SlowMist, all five referenced the same legitimate Optimism transaction but altered the recipient, token and withdrawal amounts. Each carried a valid signature from the bridge's trusted consensus signer, so withdraw() released assets without independently verifying the receipts against source-chain events. SlowMist puts the loss at about $304.5K; Blockaid's earlier alert, as reported by media, estimated about $292K.

Affected
- - Ankr cross-chain bridge contract on Ethereum (0xc437DF90B37C1dB6657339E31BfE54627f0e7181, per SlowMist; listed here for identification only, not as an indicator)
- - Withdrawn assets reported in media coverage include ankrETH, ANKR, aPOLb, aETHb and Polygon staking tokens
- - No fix available at time of publication; bridge withdrawals were reported paused

Impact
Exploitation in the wild is confirmed: five attack transactions from the same sender succeeded on Ethereum mainnet. SlowMist states that the origin of the unauthorized signatures remains under investigation and that signer compromise has not been confirmed. Ankr has not published a post-mortem at the time of publication.

Recommended actions
- - Do not interact with the Ankr bridge until Ankr confirms it is safe to resume.
- - Exchanges, bridges and DEX operators: monitor and flag funds from the attacker and recipient addresses below.
- - Bridge operators: do not rely on a single signer's attestation; verify receipts against source-chain events and reject replays of an already-processed source transaction.

Source & attribution
This 0xCERT advisory summarises a disclosure by SlowMist (https://x.com/SlowMist_Team/status/2119720284093890615), with the initial alert by Blockaid as reported by CoinInsider (https://www.coininsider.org/news/ankr-bridge-drained-as-five-forged-withdrawals-pass-signature-checks/). Indicators are copied from SlowMist's alert; 0xCERT checked that the listed attack transactions were sent by the listed attacker to the listed bridge contract. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://x.com/SlowMist_Team/status/2119720284093890615
- - https://hacked.slowmist.io/
- - https://www.coininsider.org/news/ankr-bridge-drained-as-five-forged-withdrawals-pass-signature-checks/
- - https://www.cryptotimes.io/2026/11/09/ankr-bridge-hack-304k-drained-using-forged-cross-chain-receipts/

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmryYS8JEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmcT/5KAqvUtQOrMDooIVJqp8JbY76rD/iOxEMlS
oZ36LhYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAAAhUAEAkcW5Y1GUzXvOrbPs
9RySYlMNmF3jHQNhsdnWkPMzkqEBAPgxKIgEt9w4PhWaFnT74x8TydFUuQ1O
MvCQVaRBKnsA
=Uij3
-----END PGP SIGNATURE-----