Ankr Bridge Drained of 303,600 USD as Hacker Replays Single Optimism Deposit Across Five Calls

Ankr’s cross-chain bridge was exploited for approximately 303,600 USD on November 9, 2026, after an attacker recycled a single redeemed deposit from the Optimism network to generate five unauthorized withdrawal calls on Ethereum.

By Marcus Reid | November 9, 2026

The Incident

On November 9, 2026, blockchain security analysts identified an exploit hitting the Ethereum cross-chain bridge operated by Ankr, a major provider of web3 infrastructure and liquid staking services. The intrusion resulted in the unauthorized extraction of digital assets valued at approximately 303,600 USD from the protocol’s bridge reserves. The attacker executed the theft through five consecutive withdrawal transactions on the Ethereum mainnet without needing to provide matching collateral for each request.

Cross-chain bridges act like border control checkpoints or toll bridges between different blockchain ecosystems. In this setup, users deposit funds on one network, like the Optimism layer-2 highway, and receive an equivalent voucher or unlocked token on Ethereum. Instead of sending fresh funds for each transfer, the perpetrator took a small, legitimate deposit that had already been settled and redeemed days earlier on Optimism and reused its reference data to trigger fresh payouts.

The unauthorized withdrawals siphoned an array of liquid staking tokens and platform assets directly out of the bridge inventory. According to transaction monitoring reports, the stolen stash included ankrETH, ankrPOL, ANKR, aMATICb, and aETHb. While the total sum of 303,600 USD remains relatively modest compared to recent multi-million dollar exchange breaches, the breach arrives at a sensitive moment for digital asset markets. With Ethereum trading at 2,119 USD and broader sentiment registering in Fear at 29 on the Fear and Greed index, retail investors remain hyper-sensitive to any sign of structural instability in core infrastructure.

Following the Money

The on-chain sequence moved rapidly across five discrete transactions before automated systems could halt the outflows. On-chain intelligence platforms, including SlowMist and Onchain Lens, identified the targeted deployment at contract address 0xc437DF90B37C1dB6657339E31BfE54627f0e7181. The attacker manipulated the bridge contracts to release funds directly to designated destination accounts, bypassing the standard checks that ensure each withdrawal corresponds to a brand-new deposit.

I traced the on-chain transactions directly to the bridge contract at 0xc437DF90B37C1dB6657339E31BfE54627f0e7181: the stolen funds moved swiftly into two designated destination addresses. Security firms confirmed that the transactions funneled the liquid staking tokens to primary destination wallets identified as 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6 and 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703.

The attacker swept the bridge reserves across several distinct digital tokens in rapid succession:

• Targeted contract — Ankr Ethereum bridge contract at 0xc437DF90B37C1dB6657339E31BfE54627f0e7181.
• Total verified loss — 303,600 USD drained across five unauthorized withdrawal calls.
• Assets compromised — Liquid staking and platform tokens, specifically ankrETH, ankrPOL, ANKR, aMATICb, and aETHb.
• Source origin — A single small deposit on Optimism that had already completed its redemption cycle.
• Attacker collection points — Wallets 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6 and 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703.

Once inside the destination wallets, stolen bridge assets pose a complex liquidation challenge for attackers. Liquid staking tokens like ankrETH represent staked cryptocurrency locked in interest-bearing validators. Because these tokens trade on decentralized liquidity pools with limited pool depth, dumping hundreds of thousands of dollars worth of niche tokens immediately crashes the exchange rate. Monitoring services maintain active watchlists on both recipient addresses to flag any subsequent transfers to decentralized exchanges or privacy routers.

The Weak Point

The root cause of the exploit lies in a fundamental cross-chain accounting failure known as a replay or duplicate-spending flaw. To understand how this works, imagine taking a paid paper receipt from a coffee shop, walking up to five different counters, and receiving five free meals because none of the workers marked the receipt as used. In digital finance, a smart contract is like an automated vending machine: it only releases tokens when provided with cryptographic proof that funds were deposited on the other side.

According to technical post-mortem findings from SlowMist and Blockaid, the attacker constructed five forged cross-chain withdrawal receipts based on the single historic Optimism deposit. Crucially, each of these forged receipts carried valid cryptographic signatures from the bridge’s consensus signers. The attacker modified the withdrawal parameters—including the designated recipient wallet, the token contract, and the withdrawal amounts—while relying on the valid signature framework.

The catastrophic failure occurred at the destination smart contract on Ethereum. When presented with the forged receipts, the contract verified that the cryptographic signatures were genuine, but it completely failed to verify whether the source deposit reference had already been spent. Because the protocol lacked an internal checklist to mark used transaction receipts as permanently voided, the contract happily honored the same source deposit five separate times.

This design oversight illustrates why cross-chain bridges remain the most vulnerable choke point in decentralized finance. Bridges connect independent networks that cannot read each other’s ledgers directly. When a bridge relies on trusted signers to approve transfers without requiring the destination contract to independently enforce strict single-use rules, any manipulation of the receipt format creates an open cash register for hackers.

How the Industry Responded

The response from the blockchain security sector was instantaneous. Automated threat-detection bots operated by SlowMist, Onchain Lens, and Blockaid detected the unusual outflow of staking assets and alerted developers within minutes of the fifth withdrawal transaction. Protocol engineers moved swiftly to pause bridge operations and isolate the affected contract at 0xc437DF90B37C1dB6657339E31BfE54627f0e7181 to prevent further token drainage.

Analytical firms immediately broadcast the attacker’s wallet addresses across exchange security networks. By tagging 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6 and 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703 in real-time screening software, compliance teams at major centralized exchanges can automatically freeze any incoming deposits originating from the heist.

This incident follows a grueling stretch of infrastructure attacks throughout late 2026 that have forced protocols to reassess cross-chain verification methods. Security researchers increasingly urge developers to eliminate reliance on off-chain signer consensus in favor of trust-minimized light clients or cryptographic zero-knowledge proofs. When human or multi-signature signers produce valid authorizations for reused data, destination contracts must possess native defense mechanisms to reject duplicate tickets on sight.

Lessons for Your Wallet

For everyday cryptocurrency investors, the Ankr bridge incident delivers several essential takeaways regarding asset safety and custody management. While retail users did not suffer direct wallet debits from their private accounts, holding bridge-dependent tokens carries indirect risks that every investor must understand.

• Treat bridges as temporary transit lanes — Never use a cross-chain bridge as a long-term storage vault. Move your capital across the bridge, complete your transaction, and immediately transfer your assets back into an independent self-custody wallet or cold storage device.
• Understand token backing risks — When you hold synthetic or liquid staking tokens such as ankrETH, your token’s value depends entirely on the reserve backing inside the smart contract vault. If a bridge loses its reserves, the market price of the secondary token can depeg from the native cryptocurrency.
• Regularly revoke smart contract approvals — If you have ever interacted with bridge contracts or decentralized trading pools, your wallet may retain open spending permissions. Use reputable allowance-checking tools to revoke unlimited token approvals so an exploited contract cannot reach into your wallet in the future.
• Diversify staking exposures — Avoid concentrating all your staking positions into a single provider or wrapper token. Spreading capital across native staking channels and established hardware vaults protects your portfolio against isolated smart contract vulnerabilities.

Navigating decentralized finance requires constant awareness of how protocols handle fund transfers behind the scenes. Ensuring that your personal wallet remains isolated from active bridge contracts is the most reliable defense against unexpected cross-chain exploits.

Marcus Reid’s take

Blindly trusting cryptographic signatures without verifying whether a ticket was already punched is an amateur oversight for a protocol handling millions. Tracking whether the attacker’s two collector addresses attempt to dump those 303,600 USD of illiquid staking tokens into decentralized pools will signal if laundering gates are tightening. Proof that multi-chain bridges finally enforce immutable, on-chain nullifiers across all layer-2 networks would alter my grim assessment of cross-chain plumbing.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.