On November 9, a security breach on Ankr’s Ethereum cross‑chain bridge resulted in five unauthorized withdrawals that together exceeded $303,000 in value, according to blockchain monitoring firm Blockaid. The attacker appears to have reused a tiny deposit made on Optimism on November 3 to request multiple withdrawals of different tokens on the Ethereum network.

ETH / USD
Source: CoinGecko. Prices are indicative.

How the exploit unfolded

Blockaid’s analysis shows the attacker referenced a 0.0044024803 ankrETH deposit that had already been redeemed on Ethereum. By submitting five new withdrawal requests that altered the receipt data—changing the recipient, token type, and amount—the attacker caused the bridge’s authorization logic to approve the transfers. The withdrawals occurred between 3:09 a.m. and 3:12 a.m. Eastern Time and were sent to a single destination wallet.

Assets taken and estimated value

The largest component of the loss was approximately 82.91 ankrETH, valued at about $216,370. The attacker also removed 515,206 ankrPOL tokens ($56,372) and roughly 7.98 million ANKR tokens ($30,857). Two additional assets—5,372.25 aMATICb and 0.8196 aETHb—were transferred, but their market values were not available on Etherscan at the time of reporting, so they are not included in the $303,000 estimate.

Response and broader context

Ankr’s public pause flag remained false throughout the incident, and the company had not publicly addressed the breach or confirmed whether its RPC services or other products were affected. The firm previously suffered a separate loss of about $410,000 in August when a vulnerability in its ankrFLOW contract allowed the creation of unbacked tokens. Similar bridge exploits have been reported this year, including attacks on Cysic’s BNB Smart Chain bridge and an XRPL bridge operator, highlighting ongoing challenges in cross‑chain transaction verification.

What to watch next

Investors and developers will be monitoring Ankr for any official statements regarding remediation steps, potential compensation for affected users, and whether additional security patches will be deployed. Regulators and security researchers are also expected to examine whether the flaw lies in the bridge’s signing process, receipt validation, or another component, which could influence future design standards for cross‑chain bridges.