Ankr’s Ethereum cross-chain bridge was exploited on November 9, 2026, resulting in the loss of more than $303,000 in digital assets. Security firm Blockaid first reported the incident, stating that the attacker drained the bridge’s locked funds through five unauthorized withdrawal transactions.
According to on-chain tracking by SlowMist, the attacker reused a small deposit of 0.0044 ankrETH originally made on the Optimism Network on November 3. The deposit had already been successfully redeemed. However, the attacker modified the withdrawal receipts while retaining their valid signatures.
🚨Blockaid detected an ongoing exploit on @ankr on Ethereum.
An attacker submitted five withdraw calls on Ankr’s Ethereum cross-chain bridge, using a tiny Optimism deposit to unlock the bridge’s full locked inventory to a new wallet.
~$292k drained from the bridge so far across ~5 txs. Attack still ongoing. 🧵— Blockaid (@blockaid_) November 9, 2026
This allowed the attacker to bypass the Ethereum bridge’s security checks and withdraw funds multiple times using the same deposit. The stolen assets included ankrETH, ankrPOL, and native ANKR tokens. Following the attack, the bridge was left with no balance of priced Ethereum assets. Early reports also indicated that the public contract remained unpaused immediately after the incident.
Read also: Avalanche Vault Loses $1.01M in Flash Loan Exploit
Ankr exploit raises concerns over compromised keys and verification failures
The attack exposed serious weaknesses in the bridge’s transaction verification system. On X, an AI and Blockchain developer, @Saad Altaf, suggested that the incident appeared more like an administrator key compromise than a conventional smart contract vulnerability.
According to Saad, the bridge’s own approval key validated all five fraudulent withdrawals. The associated administrative wallet had also reportedly been emptied several hours before the attack.
looks less like a code bug and more like a stolen key. every fake withdrawal was signed by the bridge’s own approval key, and that wallet got emptied hours earlier. the bridge also never checked if the deposit was already used. one key, no backup checks, whole bridge gone
— Saad Altaf (@saadaltaflaldin) November 9, 2026
This suggests that the bridge relied heavily on a single approval key without independently checking whether the original deposit had already been redeemed. As a result, compromising that key was enough to bypass the system’s security checks and drain the available funds.
Another developer and entrepreneur, Mr Dev, explained the technical weakness behind the attack. He noted that a valid cryptographic signature only confirms who authorized a transaction. It does not prove that the underlying deposit actually remains eligible for withdrawal.
Mr Dev argued that developers could prevent this type of replay attack by linking every withdrawal to its original transaction hash and log index. The bridge should then permanently mark each withdrawal receipt as used, preventing the same deposit from being processed again.
@SlowMist_Team @ankr Fix for this bug class: key each withdrawal to source tx hash + log index, mark it spent, and check the receipt matches the real source-chain event.
Five payouts off one Optimism tx means neither held. A valid signature only proves who signed, not what happened.
— Mr.DevWizard (@Dev_WhaleWizard) November 9, 2026
The attacker obtaining five separate payouts from a single Optimism deposit suggests that the bridge failed to perform this essential verification.
Investment risks of cross-chain bridges come under the spotlight
Repeated attacks on cross-chain bridges remain a major challenge for cryptocurrency adoption. Although developers promote smart contracts as the foundation of automated finance, security breaches continue to expose weaknesses in the infrastructure supporting digital asset transactions.
Blockchain hobbyist @Pudge expressed frustration with the frequency of these attacks, arguing that constant security breaches make programmable blockchains difficult to consider reliable investments.
Hacks make programmability un-investable. Worst news for crypto in years imo.
— pudge (@pudgyaf) November 9, 2026
When a cross-chain bridge loses more than $303,000 because its software fails to recognize a previously redeemed deposit, it raises questions about the reliability of the infrastructure responsible for moving assets between networks. The incident also highlights the risks associated with compromised administrator keys and inadequate transaction verification systems.
For institutional investors and other market participants considering moving traditional financial assets onto blockchain networks, security remains a major concern. Until developers introduce stronger verification mechanisms, better private-key management, and additional safeguards against single points of failure, cross-chain bridges will continue to face questions about their reliability.
The Ankr exploit reinforces the need for stronger security measures across programmable blockchain networks before they can become trusted infrastructure for mainstream financial services.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights.
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
