Ankr Ethereum Bridge Drained of 304,500 USD After Attacker Replays Old Deposit

A logic flaw on Ankr’s Ethereum cross-chain bridge allowed an attacker to drain approximately 304,500 USD in liquid staking assets on November 9, 2026, by recycling an expired deposit receipt from the Optimism network. While the financial loss represents a modest fraction of the protocol’s 21.99 million USD in total deposits, the breach exposes how signature-based bridge verification can fail when contracts omit basic replay protections, creating fresh security questions for everyday decentralized finance users.

By Priya Sharma | November 12, 2026

The Incident: Ankr Ethereum Bridge Drained of 304,500 USD

Early on November 9, 2026, automated monitoring systems at blockchain security firms Blockaid, SlowMist, and Onchain Lens detected an abnormal surge of withdrawal calls hitting Ankr’s primary Ethereum bridge contract at 0xc437DF90B37C1dB6657339E31BfE54627f0e7181. In a rapid sequence spanning barely three minutes, an unauthorized actor executed five separate withdrawal transactions, siphoning a total of 304,500 USD in digital tokens directly out of bridge reserves.

For everyday crypto investors, a cross-chain bridge functions much like an automated ferry between two islands. When a user deposits funds on one blockchain network—such as the fast, low-fee Optimism network—the bridge issues an electronic voucher. The user presents that voucher on another blockchain, like Ethereum, to collect their tokens. In this incident, the attacker figured out how to present an old, already-redeemed voucher five separate times, walking away with five separate payouts before automated defenses stepped in.

On-chain tracking confirmed that the stolen funds included liquid staking derivatives like ankrETH and ankrPOL, alongside Ankr’s native utility token, ANKR. The attacker quickly routed the proceeds into two designated destination wallets: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6 and 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703.

• Total loss — 304,500 USD drained across five unauthorized transactions in three minutes.
• Target contract — Ankr Ethereum cross-chain bridge at 0xc437DF90B37C1dB6657339E31BfE54627f0e7181.
• Compromised assets — Liquid staking tokens including ankrETH, ankrPOL, and ANKR.
• Attacker addresses — Funds received at 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6 and 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703.

Technical Post-Mortem: How Reused Deposit Receipts Fooled the Bridge

Unlike high-profile hacks that involve stolen private keys or leaked cloud passwords, this breach stemmed from an oversight in smart contract verification logic. A smart contract is simply an automated software vending machine: when predefined conditions are met, it executes without human intervention. In this case, the vending machine forgot to check whether the payment voucher had already been used.

Security analysis by SlowMist and Blockaid revealed that the attack originated from a legitimate, small deposit made six days earlier, on November 3, 2026, on the Optimism network. That initial deposit had already been processed and redeemed normally. However, the attacker retrieved the receipt data from that historical transaction and generated five forged cross-chain withdrawal receipts. By altering parameters such as recipient wallet addresses, token types, and withdrawal amounts, the exploiter created five new withdrawal commands pointing back to the same single historical deposit.

Crucially, the bridge relied on trusted off-chain signers to validate incoming requests. Because the mathematical signatures submitted with the withdrawal requests matched the expected cryptographic format, the bridge smart contract accepted the receipts as valid. The code verified that the signature was authentic, but failed to cross-check whether the underlying deposit event had already been claimed on Ethereum or if the unique transaction identifier had already been processed.

I checked the public contract code against verified transactions on Etherscan: the verification routine confirmed signer signatures properly, but completely lacked a persistent replay check to mark processed deposit nonces as spent.

Governance Impact: Circuit Breaker Delays and Signer Scrutiny

The incident has sparked renewed debate across decentralized finance about emergency governance mechanisms and bridge security. Alerts from Blockaid and on-chain monitors flagged the suspicious withdrawals as they occurred, yet public blockchain data indicated that the target bridge contract remained active and unpaused while all five fraudulent transactions executed. For everyday investors who deposit funds into yield-bearing protocols, this window of vulnerability illustrates the real-world operational lag between threat detection and contract execution.

Many decentralized protocols rely on multi-signature digital wallets—requiring several core team members or signers to approve administrative transactions—to trigger emergency pauses. While this multi-signer model prevents a single rogue developer from freezing user funds, it introduces a dangerous human delay when automated scripts drain reserves in minutes. Without mechanical, automated circuit breakers built directly into the contract code, human signers often react after the capital has already left the building.

This challenge was highlighted at the DAS London financial conference on November 11, where prominent builders, including Aave founder Stani Kulechov, argued that lending and bridge protocols must implement automated circuit breakers to protect against data anomalies and code failures. For regular retail investors, understanding whether a protocol relies on automated emergency circuit breakers or slower human committee votes is a crucial factor when assessing platform safety.

TVL Shifts: Liquid Staking Pools Absorb Outflows

Despite the operational flaw, the financial damage remained contained relative to Ankr’s overall balance sheet. According to protocol data from DefiLlama, Ankr maintains approximately 21.99 million USD in Total Value Locked across its supported blockchains, while analytics platform Token Terminal tracks protocol assets staked near 17 million USD. The 304,500 USD siphoned during the exploit amounts to roughly 1.4 percent of the protocol’s total deposits, allowing Ankr to absorb the loss without threatening core protocol solvency.

The vast majority of Ankr’s capital sits securely on Ethereum mainnet. Ethereum accounts for approximately 77.5 percent of Ankr’s total value locked, with ankrETH reserves representing between 17.4 million USD and 17.7 million USD. Ankr’s Flow staking pools hold about 4.3 million USD in ankrFLOW, with the remainder distributed across smaller allocations on BNB Chain, Avalanche, and Polygon. Because the vulnerability was isolated to the cross-chain bridging contract rather than the underlying staking derivative contracts, staked assets backing user balances remained intact.

The exploit occurred against a cautious market backdrop. The broader crypto market sentiment registered an extreme fear score of 25 on the Crypto Fear & Greed Index, with Bitcoin trading at 73,997 USD and Ethereum holding near 2,060 USD. While the exploit did not spark a panic run on ankrETH, cross-chain bridge volumes dipped as market makers and liquidity providers paused transfers until developers confirmed the contract fix was finalized.

Long-Term Prognosis: Why Cross-Chain Verification Must Evolve

For everyday investors who hold crypto or explore decentralized finance yields, this breach offers a clear lesson in how to evaluate portfolio risk. Cross-chain bridges have historically been among the most targeted components in the entire Web3 ecosystem. When moving funds between networks, investors are not just trusting the blockchains themselves; they are trusting the code connecting them.

To eliminate replay attacks of this nature, protocols must upgrade from simple signature verification to robust on-chain state verification. Smart contracts need mandatory tracking arrays—often referred to as nullifier lists—that permanently record every redeemed deposit identifier in blockchain storage. Once a deposit voucher is processed, the contract must mechanically reject any subsequent request bearing that same identifier, regardless of whether the signature appears valid.

For regular market participants, practical risk management remains straightforward. Holding liquid staking tokens like ankrETH directly on Ethereum mainnet carries less operational risk than bridging those tokens back and forth across multiple networks to chase marginal yield differences. Minimizing unnecessary bridge hops and keeping core holdings in primary settlement layers protects everyday investors from technical vulnerabilities in cross-chain plumbing.

Priya Sharma’s take

Treating offchain signature validity as proof of a genuine deposit exposes the persistent flaw of building cross-chain bridges without strict on-chain replay storage. Upcoming audit releases verifying whether Ankr embeds immutable nullifiers across its remaining 21.99 million USD in multi-chain contracts will determine if this fix holds under stress. Fresh evidence showing similar signature verification bypasses in other bridge endpoints would turn my cautious assessment of this containment into a full warning.

The cryptocurrency market remains highly volatile. This article is for informational purposes only and does not constitute financial advice.