Ankr Ethereum Bridge Loses $303,000 in Five-Transaction Exploit After Attacker Reuses Old Optimism Deposit

Published November 9, 2026, 7:15 PM PKT. Based on Blockaid's alert on November 9, 2026 and on-chain transaction records as reported by crypto.news (primary source), with root-cause analysis from SlowMist, early loss estimates from PeckShield, and reporting by The Defiant.

Ankr's ($ANKR) Ethereum ($ETH) cross-chain bridge lost more than $303,000 on November 9, 2026 after an attacker reused a tiny deposit made through Optimism ($OP) that had already been redeemed, submitting five forged withdrawal receipts in three minutes to empty the bridge's locked inventory. Blockchain security firm Blockaid flagged the attack as an ongoing exploit in a public alert at 08:42 UTC, about half an hour after the withdrawals landed.

The five withdrawals removed about $303,600 in priced tokens from the bridge's Ethereum ($ETH) contract, according to crypto.news, while blockchain security firm SlowMist put the total slightly higher at about $304,500 after its own analysis. PeckShield's earlier estimate was about $286,000, and the firm reported that the attacker swapped most of the haul into 103 Ether ($ETH).

Five withdrawals in three minutes drained the bridge

The attack ran between 08:09 and 08:12 UTC, or 1:09 PM and 1:12 PM PKT, with five successful withdrawals sending different tokens to the same destination wallet, according to transaction records cited by crypto.news. The largest single withdrawal took about 82.91 ankrETH, worth about $216,370. A second withdrawal removed 515,206 ankrPOL tokens valued at about $56,372, and a third took about 7.98 million Ankr ($ANKR) tokens worth about $30,857.

Two more assets, 5,372.25 aMATICb and 0.8196 aETHb, were also transferred during the attack. Their values were not included in the $303,600 estimate because Etherscan showed no prices for either token at the time of the assessment, according to crypto.news. Together, the five withdrawals stripped the bridge's Ethereum ($ETH) contract of its listed token holdings.

By 08:49 UTC, about 40 minutes after the withdrawals, the bridge's transaction history showed no further activity. But its public pause flag, the switch that stops withdrawals, still showed false, leaving it unclear whether Ankr had taken any additional measures to stop further unauthorized transactions. On-chain monitoring account Onchain Lens separately flagged the withdrawals with a similar early loss estimate.

A redeemed Optimism deposit did the damage

The exploit centered on a deposit originally made through Optimism ($OP), a layer-2 network, on November 3. The deposit was just 0.0044024803 ankrETH, and Ethereum ($ETH) records show it had already been redeemed that same day, according to crypto.news.

On November 9, the attacker referenced that same deposit when submitting five new withdrawal requests. Each request carried modified receipt information identifying a different recipient, larger withdrawal amounts, and different tokens from the original transfer, according to the transaction analysis. Ankr's bridge normally lets users move supported liquid staking assets between blockchains: a user deposits tokens on the originating network, then submits the transaction for verification through Ankr's backend, which provides the authorization needed to release assets on the receiving network.

Under that arrangement, a completed deposit should not authorize repeated withdrawals for different assets or amounts. The reported transactions nevertheless passed the bridge's authorization checks. The deployed bridge implementation requires approval from a designated signer before processing withdrawals, and the available records do not establish how the attacker obtained valid authorization, or whether the weakness sat in the signing process, the receipt validation, or another component.

SlowMist points to forged receipts and an open signer question

SlowMist, another blockchain security firm, published a root-cause analysis of the attack. It found that the attacker reused one legitimate Optimism ($OP) transaction from November 3, the deposit of just 0.0044024803 ankrETH that had already been withdrawn on Ethereum ($ETH) the same day, and built five forged withdrawal receipts on top of it. SlowMist estimated the loss at about $304,500.

The firm said the source of the unauthorized signatures is still under investigation, and it has not confirmed that the signer keys were compromised. Until Ankr publishes its own post-mortem and confirms a pause, containment remains an open question rather than a completed fact.

Ankr had not published a statement confirming containment, a root cause, or a recovery plan at the time of reporting, and crypto.news said the company had not responded to its questions about affected services, bridge security, or possible user reimbursements. There was no confirmation that the exploit had compromised Ankr's remote procedure call infrastructure or users' personal wallets. The reported withdrawals concerned assets held in the affected Ethereum ($ETH) bridge contract, although the company had not publicly established the full scope of the incident.

Ankr's second incident in about ten weeks

The bridge exploit is the second security incident involving Ankr contracts in about ten weeks. On August 31, 2026, a flaw in Ankr's ankrFLOW liquid staking contract let an attacker create about 8.6 million unbacked ankrFLOW tokens, resulting in about $410,000 in losses from MORE Markets, according to crypto.news. Ankr also suffered a far larger exploit in December 2022, when its aBNBc staking token was attacked for about $5 million.

Other bridge operators have faced similar authorization problems this year. In October, Cysic suspended its bridge after an attacker reportedly exploited processing weaknesses to create 10 million unauthorized CYS ($CYS) tokens on BNB Smart Chain ($BNB). In August, an XRPL bridge operator reported losing 198,715.88 XRP ($XRP) after attackers exploited faulty deposit detection logic, halted the affected bridge, and filed a complaint with the FBI. Users with assets linked to the Ankr bridge should watch Ankr's official channels for updates on a pause, the signer investigation, and any recovery plan.

Sources

• crypto.news, Ankr bridge exploit drains $303K after Optimism deposit reused, November 9, 2026 (primary source: Blockaid alert 08:42 UTC November 9, 2026; five withdrawals 08:09 to 08:12 UTC; 82.91 ankrETH worth $216,370, 515,206 ankrPOL worth $56,372, about 7.98 million Ankr worth $30,857, plus 5,372.25 aMATICb and 0.8196 aETHb; deposit of 0.0044024803 ankrETH on Optimism on November 3, redeemed same day; pause flag still false at 08:49 UTC; Ankr had not responded; August 31 ankrFLOW incident, about $410,000 in losses from MORE Markets; Cysic bridge suspension in October; XRPL bridge operator loss of 198,715.88 XRP ($XRP) in August)
• The Defiant, Ankr Ethereum Bridge Loses More Than $303,000 in Five-Transaction Exploit, November 9, 2026 (secondary reporting: five withdrawals removed about $303,600 in priced tokens; contract remained unpaused in a 08:49 UTC check)
• CryptoTimes, $304K Drained Using Forged Cross-Chain Receipts, November 9, 2026 (secondary reporting: SlowMist root-cause analysis, loss estimated at about $304,500; source of unauthorized signatures still under investigation; signer keys not confirmed compromised; Ankr had not published a statement)
• Blockchain.News, Ankr: PeckShield Reports $286K Exploit, November 9, 2026 (secondary reporting: PeckShield estimate of about $286,000; attacker swapped the bulk into 103 Ether)
• MABOnChain, zkLink Nova Bridge Exploit Drains $786K After Forged Batch Root Slips Past Verifier, November 2026 (secondary context: a recent bridge exploit on MABOnChain's own coverage)

This article is news reporting and is not investment advice.