Ankr Ethereum Bridge Exploited for Over $303,000 via Reused Optimism Deposit
Ankr's Ethereum cross-chain bridge lost more than $303,000 in five unauthorized withdrawals on November 9, according to Blockaid and on-chain monitor Onchain Lens. The attacker reused a small Optimism deposit that had already been redeemed, and the bridge's pause flag remained unset in the reporting window.
Written by CoinArticle’s AI Newsroom · from 2 cited sources. How we work
What Happened
An attacker drained more than $303,000 in crypto assets from Ankr's Ethereum cross-chain bridge through five withdrawals on November 9, according to Crypto.news. Blockaid first flagged the activity on Monday with an initial loss estimate of about $292,000 across the five transactions, while Onchain Lens reported a similar early figure. The sources differ on the final tally: Blockaid's initial estimate was roughly $292,000, and later analysis of the withdrawn tokens put the combined value above $303,000.
The withdrawals ran from 3:09 a.m. to 3:12 a.m. Eastern Time and sent different tokens to a single destination wallet. The largest component was about 82.91 ankrETH, valued at $216,370. Another 515,206 ankrPOL tokens were valued at $56,372, and roughly 7.98 million ANKR tokens at $30,857.
The Reused Deposit
The exploit centered on a deposit made through Optimism on November 3, involving 0.0044024803 ankrETH. According to transaction analysis reported by The Defiant and Crypto.news, that deposit had already been redeemed on Ethereum the same day. The attacker nonetheless referenced it in five new withdrawal requests on November 9, each with modified receipt data naming a different recipient, larger amounts, and different tokens.
Under the bridge's design, a completed deposit should not authorize further withdrawals, let alone for different assets. The five transactions nevertheless passed the bridge's checks. The available reporting does not establish how the attacker obtained valid authorization, or whether the failure lay in the signing process, receipt validation, or another component.
Valuation Caveats and Open Questions
The $303,000 figure covers only three priced assets. Two other tokens, 5,372.25 aMATICb and 0.8196 aETHb, were also transferred, but Etherscan did not display prices for them at the time of assessment, so they are excluded from the total. The figure is therefore a floor on the value removed, not a complete accounting. It also reflects estimated market value rather than what the attacker has converted to other assets.
As of 3:49 a.m. Eastern Time, the bridge's transaction history showed no further activity after the withdrawals, but its public pause flag still read false. The reporting does not confirm whether Ankr had taken further containment steps, and the extent of the breach remains unresolved. Blockaid described the exploit as ongoing at the time of its report, a status the sources do not update.
Why It Matters
For Traders
Holders of ANKR and Ankr liquid staking tokens should watch for Ankr's containment statement, since the pause flag was still unset during the reporting window.
For Investors
A reused-deposit exploit on a live bridge raises durable questions about Ankr's verification controls, regardless of how the loss is ultimately recovered or compensated.
For Builders
Any bridge that treats deposit receipts as single-use must enforce nonce or spent-receipt tracking on the destination chain, not rely on backend attestation alone.
This article is for information only and is not financial advice. Read the full disclaimer.
