Key Takeaways:
Blockaid reviews that about $292,000 had been stolen from Ankr’s Ethereum bridge by 5 suspicious withdrawals.The attacker is claimed to have used a small Optimism deposit to withdraw a number of property.A number of Ankr operator wallets throughout three totally different networks had been drained and merged right into a single pockets days earlier than the exploit.
Hackers exploited Ankr’s Ethereum Cross Chain bridge with 5 unauthorized withdrawals. Blockchain safety agency Blockaid detected the exercise on November 9, 2026, and warned that the assault was nonetheless ongoing when it printed its alert.
🚨Blockaid detected an ongoing exploit on @ankr on Ethereum.An attacker submitted 5 withdraw calls on Ankr’s Ethereum cross-chain bridge, utilizing a tiny Optimism deposit to unlock the bridge’s full locked stock to a brand new pockets.~$292k drained from the bridge thus far throughout ~5 txs. Assault nonetheless ongoing. 🧵
— Blockaid (@blockaid_) November 9, 2026
The incident factors to the priority about how the bridge verifies the cross-chain transaction and grants asset releases.
One Optimism Deposit Linked to 5 Withdrawals
Blockaid states that the attacker made 5 withdrawal calls on the Ankr’s Ethereum bridge. These transactions reportedly concerned depositing a small quantity from Optimism to unlock property from the Ethereum bridge contract.
The corporate estimated it misplaced about $292,000 in whole in about 5 transactions. The cash was moved to the withdrawing pockets in a brand new pockets tackle. It was not a single asset, it was a number of property. These included Ankr-related liquid staking tokens and ANKR, Ankr’s native cryptocurrency.
Often, a cross-chain bridge will unlock property on a distinct chain following a deposit on the originating chain. If it has the identical transaction as proof of authorisation for an additional withdrawal, a single deposit would possibly probably be used greater than as soon as.
However Blockaid’s first alert did not element the precise technical flaw or how the attacker bought previous the authorization controls on the bridge.
Learn Extra: Initia Halts L1 and Rollups After $2.7M Exploit Tied to Unauthorized Token Minting
Ankr Operator Wallets Have been Swept Earlier than the Assault
The on-chain exercise that led as much as the withdrawals additionally contributes to the prevalence. The Blockaid reported that between the time of 02:08 and 04:06 UTC, a number of Ankr operator wallets had been emptied all through Ethereum, Arbitrum and Linea. The cash was deposited to a single consolidation pockets.
Subsequent, the attacker transacted with this pockets to pay the payment for the relayer that submitted the transactions to the bridge.
It seems the assaults had been executed after the attacker ready the transaction infrastructure. However solely the pockets strikes don’t present how entry to the operator wallets obtained and if their personal keys breached.
5 Transactions Focused the Ethereum Bridge
Blockaid discovered two exploit addresses and offered an instance transaction with the exploited bridge contract.
All the withdrawals had been in the direction of the identical Ethereum Bridge, capital was despatched to the attackers’ withdrawal pockets. The reported loss is for the cash drained when Blockaid warned, not a remaining tally of the incident.
That’s important as a result of the assault continues to be energetic, even throughout the time of the alert despatched by the safety agency. The last word losses might be impacted by further transactions and/or value changes for tokens.
The incident places cross-chain verification below scrutiny. Bridges depend upon dependable communication between networks, and their safety depends on appropriately validating deposits, messages, and withdrawal authorizations.
A failure in any a part of that course of can expose property held in bridge contracts, even when the unique deposit is reliable.
Learn Extra: Binance Reveals How Hackers Moved $6.34B After Breaching Its Pockets-Signing System
