Ankr Ethereum Bridge Loses More Than $303,000 in Five-Transaction Exploit

An attacker withdrew five types of tokens from Ankr’s Ethereum cross-chain bridge on Nov. 9, with three of those assets valued at about $303,600, according to onchain records and The Defiant’s calculation using Etherscan prices.

The five successful withdrawals sent the tokens to the same wallet between 3:09:35 a.m. and 3:11:59 a.m. ET. At 3:49 a.m. ET, the bridge’s transaction list showed no subsequent transaction, no $ETH balance and $0 in priced Ethereum token holdings. Its public pause flag still read false, leaving containment unconfirmed.

Security firm Blockaid reported an “ongoing exploit” at 3:42 a.m. ET, saying an attacker had used a small Optimism deposit to unlock the bridge’s inventory.

The transfers included Ankr’s staked $ETH and POL tokens, its $ANKR token, and the aMATICb and aETHb staking tokens. The dollar estimate sums Etherscan’s displayed values for ankrETH, ankrPOL and $ANKR at 3:46 a.m. ET; it excludes the two tokens without quoted prices and is not a measure of realized sale proceeds.

Assets Removed From Ankr’s Ethereum Bridge

Source: Ethereum transfer records and Etherscan holdings. Dollar values displayed at 3:46 a.m. ET on Nov. 9, 2026; aMATICb and aETHb were unpriced. Quantities rounded.

Withdrawals Referenced an Already-Redeemed Deposit

Ankr’s documentation describes a bridge that moves liquid-staking tokens between networks. Users deposit on one network, submit the transaction to Ankr’s backend for notarization, then withdraw on the destination network.

All five withdrawals referenced the same Nov. 3 Optimism transaction, which deposited just 0.0044024803 ankrETH for transfer to Ethereum. That amount had already been withdrawn on Ethereum on Nov. 3.

The new withdrawal calls supplied altered receipt data naming a different recipient and larger amounts, with different output tokens. The deployed implementation requires authorization from the bridge’s designated signer before releasing funds. The records establish that the withdrawals passed that check, but do not establish how the attacker obtained accepted authorization.