Ankr Ethereum bridge loses more than $303,000 in exploit

The withdrawals occurred between 3:09 a.m. and 3:12 a.m. Eastern Time and sent five different tokens to the same wallet. Blockaid initially estimated losses at about $292,000; later analysis put the combined value of the three tokens with listed prices at more than $303,000.

The largest withdrawal was approximately 82.91 ankrETH, valued at $216,370. The attacker also took 515,206 ankrPOL worth $56,372 and about 7.98 million ANKR valued at $30,857. Two other assets—5,372.25 aMATICb and 0.8196 aETHb—were transferred, but their values were excluded because Etherscan did not show prices for them. The estimate is not evidence that the assets were converted into other tokens or cash.

According to transaction analysis, the attacker referenced a deposit of 0.0044024803 ankrETH made through Optimism on Nov. 3 and redeemed on Ethereum that day. On Nov. 9, five withdrawal requests reportedly reused that deposit while changing receipt details, recipients, amounts and tokens. Ankr’s bridge uses backend verification to authorize releases on the receiving network, and its deployed implementation requires approval from a designated signer. Available records do not show how the attacker obtained valid authorization or identify the component that failed.

Blockaid described the exploit as ongoing. At 3:49 a.m. Eastern Time, the bridge’s transaction history showed no further activity, but its public pause flag remained false. Ankr had not responded to questions about affected services, security measures or possible reimbursements. There was no confirmation that the incident affected Ankr’s RPC services or users’ personal wallets; the reported withdrawals involved assets in the affected Ethereum bridge contract.

Ankr previously reported a separate incident in August, when a vulnerability in its ankrFLOW contract allowed an attacker to create unbacked tokens and caused approximately $410,000 in losses from MORE Markets. Other bridge incidents cited this year include Cysic’s October suspension after unauthorized CYS tokens were reportedly created on BNB Smart Chain, and an August exploit of an XRPL bridge that led to the loss of 198,715.88 XRP.