A genuine signature doesn’t mean this money belongs to you.
At 08:42 London time on November 9, Blockaid sounded the alarm: Ankr’s Ethereum cross-chain bridge was under attack. The attacker used a tiny Optimism deposit to call withdraw() five times in a row. SlowMist’s root-cause analysis found that all five cross-chain receipts referenced the same genuine Optimism transaction, but the recipient, token, and amount had been altered—and each receipt carried the bridge’s trusted consensus signature. Estimates of the losses range from $286,000 to $305,000. The stolen assets included ankrETH, aMATICb, ankrPOL, and ANKR; most have been swapped for ETH. So far, Ankr has not made a public statement.
From an engineer’s perspective:
· The contract only checks whether the “stamp is genuine”; it doesn’t verify against the source chain what the deposit contained or whether it had already been redeemed.
· One deposit could be redeemed five times, which means receipts weren’t bound one-to-one to source-chain events, and there was no replay protection.
· The source of the signatures is still under investigation. It has not been confirmed whether the signers were compromised.
Three tips for token holders:
1) If you hold cross-chain assets such as ankrETH or ankrPOL, check official announcements first, and don’t click any “recovery links.”
2) Keep only funds you’re actively moving in cross-chain bridges; hold long-term assets on their native chain.
3) Before making a large cross-chain transfer, check whether there are independent validations, per-transaction limits, and an emergency pause feature.
A bank teller would still check the transaction history when shown an old stamped receipt, but a bridge handling hundreds of thousands of dollars only checks the stamp. Do you think cross-chain bridges should be required to impose withdrawal limits? Tell us in the comments 😏
#链上安全 #CrossChainBridge
$ANKR
At 08:42 London time on November 9, Blockaid sounded the alarm: Ankr’s Ethereum cross-chain bridge was under attack. The attacker used a tiny Optimism deposit to call withdraw() five times in a row. SlowMist’s root-cause analysis found that all five cross-chain receipts referenced the same genuine Optimism transaction, but the recipient, token, and amount had been altered—and each receipt carried the bridge’s trusted consensus signature. Estimates of the losses range from $286,000 to $305,000. The stolen assets included ankrETH, aMATICb, ankrPOL, and ANKR; most have been swapped for ETH. So far, Ankr has not made a public statement.
From an engineer’s perspective:
· The contract only checks whether the “stamp is genuine”; it doesn’t verify against the source chain what the deposit contained or whether it had already been redeemed.
· One deposit could be redeemed five times, which means receipts weren’t bound one-to-one to source-chain events, and there was no replay protection.
· The source of the signatures is still under investigation. It has not been confirmed whether the signers were compromised.
Three tips for token holders:
1) If you hold cross-chain assets such as ankrETH or ankrPOL, check official announcements first, and don’t click any “recovery links.”
2) Keep only funds you’re actively moving in cross-chain bridges; hold long-term assets on their native chain.
3) Before making a large cross-chain transfer, check whether there are independent validations, per-transaction limits, and an emergency pause feature.
A bank teller would still check the transaction history when shown an old stamped receipt, but a bridge handling hundreds of thousands of dollars only checks the stamp. Do you think cross-chain bridges should be required to impose withdrawal limits? Tell us in the comments 😏
#链上安全 #CrossChainBridge
$ANKR