Ankr’s Ethereum cross-chain bridge suffered an exploit on November 9, 2026, resulting in losses exceeding $303,000 in digital assets. Blockaid, a blockchain security firm, reported that the attacker drained the entirety of the bridge’s locked funds by executing five unauthorized withdrawal transactions.
Technical details of the Ankr bridge attack
Analysis by the blockchain security company SlowMist indicated that the attacker began by reusing a small ankrETH deposit of 0.0044 tokens on the Optimism Network, which had originally been made on November 3. SlowMist noted that the deposit had already been redeemed successfully once. By manipulating withdrawal receipts but maintaining valid cryptographic signatures, the attacker was able to resubmit the same deposit for multiple withdrawals.
Mini dictionary: Optimism Network is a Layer 2 scaling solution for Ethereum, designed to increase transaction speeds and reduce costs by processing transactions off the main Ethereum blockchain while maintaining compatibility and security.
Using this technique, the attacker bypassed the bridge’s normal security checks and withdrew ankrETH, ankrPOL, and native ANKR tokens. After the incident, there were no priced Ethereum assets left in the bridge. Reports indicated that the contract remained unpaused in the immediate aftermath, exposing further vulnerabilities.
Blockaid confirmed, “An attacker submitted five withdraw calls on Ankr’s Ethereum cross-chain bridge, using a tiny Optimism deposit to unlock the bridge’s full locked inventory to a new wallet. About $292,000 was drained across five transactions.”
Concerns over key management and transaction verification
The exploit highlighted significant weaknesses in the bridge’s transaction verification process. Saad Altaf, an AI and Blockchain developer, claimed on X that the exploit looked more like an administrator key compromise than a flaw in the smart contract code itself. Altaf explained that every fraudulent withdrawal was approved by the bridge’s own administrative key, and noted that the administrative wallet had been emptied hours before the exploitation took place.
One developer pointed out, “Every fake withdrawal was signed by the bridge’s own approval key, and that wallet got emptied hours earlier. The bridge also never checked if the deposit was already used. One key, no backup checks, whole bridge gone.”
This dependency on a single approval key without backup verification checks allowed attackers to drain all available funds by compromising that key alone. The code did not verify if a deposit had already been redeemed when approving withdrawals, worsening the risk.
Developer and entrepreneur Mr Dev explained the underlying technical issue, stating that signatures in themselves merely prove who authorized a withdrawal but do not check whether a deposit remains valid for withdrawal. Mr Dev advised that linking each withdrawal to its unique transaction hash and source event, then marking it as spent, would prevent attackers from double-spending a single deposit.
Five separate payouts from the same Optimism deposit confirmed that the bridge’s system failed to enforce this fundamental check, exposing it to replay attacks.
Wider implications for cross-chain bridge security
Security breaches at cross-chain bridges like Ankr’s present ongoing risk for the cryptocurrency sector. Although smart contracts are widely promoted as tools for financial automation, infrastructure weaknesses continue to pose challenges for asset movement and investor confidence.
Crypto enthusiast Pudge pointed out that repeated hacks erode confidence in programmable blockchains, making it harder for users and investors to trust these systems as reliable financial tools.
The incident also illustrated the particular dangers of weak key management and insufficient transaction scrutiny. Ankr’s bridge was unable to distinguish between already-redeemed and eligible deposits, creating an opportunity for attackers to drain its funds rapidly.
Security concerns remain a primary consideration for institutional investors and other stakeholders evaluating blockchain-based infrastructure. Without improved transaction verification systems, stronger key protection, and robust backup processes, cross-chain bridges risk further attacks that could undermine broader adoption.
| Bridge | Loss Amount | Exploit Method | Vulnerability |
|---|---|---|---|
| Ankr | $303,000 | Replay of valid deposit receipts | Compromised admin key & insufficient deposit validation |
| Avalanche Vault (reference) | $1.01 million | Flash loan exploit | Lack of protocol safeguards |
The Ankr incident underscores the need for upgraded security standards across the programmable blockchain ecosystem. Until such improvements are implemented, the risks to digital asset infrastructure are expected to persist.
