Ankr’s Ethereum cross-chain bridge was hit by an exploit on Nov. 9 that allowed an attacker to siphon more than $303,000 in crypto, exposing troubling gaps in the bridge’s transaction verification process. What happened - Blockchain security firm Blockaid first flagged the incident, calling it an “ongoing exploit.” Onchain Lens also alerted the community. According to on-chain records, the attacker executed five withdrawals between 3:09 a.m. and 3:12 a.m. Eastern Time, moving all stolen assets into a single destination wallet. - Early estimates by Blockaid put losses at about $292,000; later token-price checks raised the combined value of the priced assets to roughly $303,600. Two withdrawn tokens (5,372.25 aMATICb and 0.8196 aETHb) had no prices displayed on Etherscan at the time and were excluded from that estimate. Breakdown of assets removed - ~82.91 ankrETH — about $216,370 (largest component) - 515,206 ankrPOL — about $56,372 - ~7.98 million ANKR — about $30,857 - plus the unpriced aMATICb and aETHb transfers noted above How the attacker did it - The exploit centers on a tiny deposit originally submitted via Optimism on Nov. 3: 0.0044024803 ankrETH, which had reportedly already been redeemed on Ethereum the same day. - On Nov. 9, the attacker referenced that same deposit when issuing five new withdrawal requests. Each request included altered receipt details that specified different recipients, larger withdrawal amounts, and different tokens than the original transfer. - Ankr’s bridge normally requires a designated signer’s approval to authorize withdrawals after backend verification of a deposit. The accepted withdrawals indicate a failure somewhere in the authorization chain — whether in the signing process, receipt validation, or another component — but available records do not identify the exact vector. Operational status and scope - At 3:49 a.m. ET the bridge’s transaction history showed no further activity, and its public pause flag remained set to “false,” leaving uncertainty about whether Ankr took internal steps to halt operations. - It is not yet confirmed whether the breach affected Ankr’s broader infrastructure — including RPC services — or users’ wallets. The withdrawals relate to assets held in the specific Ethereum bridge contract. - crypto.news contacted Ankr for comment; the company had not responded by press time. Context and precedent - This is not Ankr’s first incident. In August, a vulnerability in ankrFLOW allowed creation of millions of unbacked tokens and led to roughly $410,000 in losses tied to MORE Markets. - Other bridge operators have suffered similar authorization and deposit-detection failures this year: in October, Cysic suspended its bridge after an attacker created 10 million unauthorized CYS tokens on BNB Smart Chain, and in August an XRPL bridge reported 198,715.88 XRP stolen after faulty deposit detection logic. Why this matters Cross-chain bridges are frequent targets because they hold concentrated liquidity and rely on complex verification and signing systems. A flaw that lets a single referenced deposit authorize multiple, altered withdrawals undermines the fundamental trust assumptions of bridge architecture and raises urgent questions about verification robustness and signer security. What’s next Investigators and security teams are still piecing together how authorization was bypassed and whether other contracts or services were impacted. Users and projects that interact with Ankr’s bridge should monitor official updates and on-chain alerts as the investigation continues. Read more AI-generated news on: https://app.chaingpt.org/news