Blockaid Flags Ankr Bridge Exploit Draining $303K Via Optimism (OP) Deposit

Five Withdrawals in Three Minutes

Blockaid, a blockchain security firm, flagged an “ongoing exploit” on Ankr's Ethereum cross-chain bridge protocol on Monday, Nov. 9, after an attacker submitted five unauthorized withdrawal calls that drained more than $303,000 in assets, raising fresh questions about the bridge's transaction verification process. The firm's alert on X described how the attacker used a small deposit previously made through Optimism (OP), negligible at current Optimism price levels, to release the bridge's entire locked inventory to a fresh wallet. Blockaid's initial estimate put the losses at approximately $292,000 across five transactions, and subsequent analysis of the withdrawn tokens lifted their combined value above $303,000. The on-chain monitoring account Onchain Lens separately flagged the withdrawals, reporting a similar early estimate. The transactions involved Ankr's liquid staking assets alongside its native ANKR token.

The five withdrawals landed between 3:09 and 3:12 a.m. Eastern Time, sending different tokens to one destination wallet. Transaction records show the attacker removed approximately 82.91 ankrETH worth $216,370, the largest component of the reported losses. A second withdrawal took 515,206 ankrPOL tokens valued at $56,372, and roughly 7.98 million ANKR tokens accounted for another $30,857. Two further assets, 5,372.25 aMATICb and 0.8196 aETHb, also left the contract during the same window, though their values were excluded from the $303,600 estimate because the block explorer did not display prices for either token at assessment time. The total therefore reflects three priced assets, not necessarily what the attacker has converted into other cryptocurrencies or cash. The five withdrawals nevertheless stripped the Ethereum contract of its listed token holdings, and by 3:49 a.m. Eastern Time nothing further had moved through the bridge after the suspicious transactions.

A Redeemed Deposit Referenced Six Days Later

On-chain records trace the exploit to a deposit originally made through the Optimism network, a layer-2 blockchain, on Nov. 3. The deposit came to just 0.0044024803 ankrETH, and Ethereum records show it had been redeemed that same day. The attacker nevertheless referenced it when submitting five new withdrawal requests on Nov. 9, each carrying modified receipt information that named a different recipient, larger amounts, and tokens other than the original transfer.

Ankr's bridge normally lets users move supported liquid staking assets between networks, a routine function of omnichain design. A user deposits tokens on the originating network before submitting the transaction for verification through Ankr's backend, which supplies the authorization needed to release assets on the receiving chain. By that design, a finished deposit ought never to authorize repeated withdrawals of different assets or amounts. These five requests still passed the bridge's authorization checks.

The deployed implementation demands approval from a designated signer before any withdrawal is processed, meaning a private key holder must validate each release. The available records do not establish how the attacker obtained valid authorization, or whether the weakness sat in the signing process, receipt validation, or another component. No evidence has surfaced that Ankr's remote procedure call services or users' personal wallets were affected; the withdrawals concerned assets held in the Ethereum bridge contract. Ankr also operates liquid staking services and broader blockchain infrastructure, so the scope question extends beyond a single contract. The bridge's public pause flag still showed false as of 3:49 a.m. Eastern Time, leaving unclear whether the team had taken further containment measures. Ankr had not answered questions about affected services, bridge security, or possible user reimbursements by press time.

The on-chain evidence is unusually clean: the five withdrawal transactions and their token amounts are verifiable on Ethereum, confirming that a deposit redeemed six days earlier still carried weight in the bridge's verification path. What the records do not show is a post-mortem. Ankr has published no incident report naming the root cause, so the signer authorization question stays open: the withdrawals passed a check that should have required a designated signer, and no public record explains how. The pattern is familiar. In October, Cysic suspended its bridge after an attacker allegedly minted 10 million unauthorized CYS tokens on BNB Smart Chain, and in August a flaw in Ankr's own ankrFLOW contract enabled roughly $410,000 in losses from MORE Markets. Until the team publishes its post-mortem and confirms a pause, containment remains an intention, not a completed fact.