An attacker drained more than $303,000 from Ankr's Ethereum cross-chain bridge on Monday by reusing a single small deposit on Optimism to trigger five separate withdrawals, according to blockchain security firm Blockaid, which flagged the incident as still in progress.
The withdrawals landed between 3:09 a.m. and 3:12 a.m. Eastern Time, each routed to the same destination wallet. Blockaid's first estimate put the haul at roughly $292,000; a later tally of the tokens taken lifted the figure above $303,000. On-chain monitoring account Onchain Lens independently spotted the transfers and arrived at a similar early figure.
Ankr had not answered questions about which services were affected, how the bridge's safeguards failed, or whether users would be made whole by the time of publication.
The assets removed from the bridge contract were a mix of Ankr's liquid staking tokens and its own ANKR token.
Note: The $303,000-plus total reflects only the three assets for which Etherscan displayed prices at the time of the assessment. It is an estimate of token value, not a confirmed amount converted to other cryptocurrencies or cash.
The mechanics point to a flaw in how the bridge validates deposits. The transaction the attacker leaned on was originally made through Optimism on Nov. 3: a deposit of just 0.0044024803 ankrETH that had already been redeemed on Ethereum the same day. On Monday, the same deposit was cited in five fresh withdrawal requests, each carrying altered receipt data that named a different recipient, a larger amount and a different token from the original transfer.
Ankr's bridge is designed to let users shuttle supported liquid staking assets between networks. A user locks tokens on the source chain, the transaction goes to Ankr's backend for verification, and that check supplies the authorization needed to release assets on the destination chain. In principle, a completed deposit should never authorize repeat releases of other assets or larger sums. These five requests cleared authorization anyway.
The deployed implementation requires sign-off from a designated signer before a withdrawal is processed. Records reviewed so far do not show how the attacker obtained valid authorization, or whether the weak point sat in the signing step, in receipt validation, or elsewhere in the stack.
By 3:49 a.m. Eastern Time the bridge's transaction history showed no further movement. Its public pause flag still read false, leaving it unclear whether Ankr had taken any additional steps to block further unauthorized calls.
There is no confirmation that the breach reached Ankr's remote procedure call infrastructure, the service applications use to communicate with blockchains, or that personal wallets were compromised. The losses are confined to assets held in the affected Ethereum bridge contract, though the company has not publicly mapped the full scope of the incident. Whether the affected contracts share infrastructure with other Ankr products also remains unresolved.
The episode adds to a rough record for the project. In August, a flaw in its ankrFLOW contract let an attacker mint millions of unbacked tokens, producing about $410,000 in losses at MORE Markets. Cross-chain bridges have drawn repeated attacks across decentralized finance because they pool liquidity across many smart contract interactions, widening the surface an intruder can probe compared with single-chain protocols.
Peers have stumbled on transaction authorization as well. In October, Cysic halted its bridge after an attacker reportedly exploited processing weaknesses to create 10 million unauthorized CYS tokens on BNB Smart Chain. In August, an XRPL bridge operator said it lost 198,715.88 XRP after attackers gamed faulty deposit-detection logic, shut the bridge and filed a complaint with the FBI.
For holders of Ankr's staking derivatives, the immediate question is whether the affected contract's remaining balances are safe and whether redemptions will be honored. The reuse of an already-settled deposit suggests the bridge's verification layer, rather than its token contracts, is the focal point of any post-mortem. Until Ankr publishes one or on-chain analysts attribute the wallets involved, the size of the loss and the identity of the attacker remain unverified beyond Blockaid's and Onchain Lens's readings of the chain.
