Ankr Bridge Exploit: $303K Drained With Forged Receipts

Quick answer: On November 9, 2026, an attacker drained about $303,000 from Ankr's Ethereum bridge using five forged withdrawals that reused an old Optimism deposit. Stolen assets included ankrETH, ankrPOL and ANKR. The root cause is not confirmed and Ankr had not commented at press time. Avoid using the bridge until Ankr confirms it is safe.

What happened to the Ankr bridge

Ankr runs a bridge that moves its liquid staking tokens, such as ankrETH and ankrPOL, between networks. According to Ankr's bridge documentation, the bridge uses a lock-and-unlock model, where tokens are locked on one chain and released on another.

On Monday, November 9, 2026, the bridge contract on Ethereum released assets in five withdrawals that were not backed by real deposits. crypto.news reported that the five withdrawals happened between 3:09 and 3:12 a.m. ET and all went to the same destination wallet.

Blockchain security firm SlowMist lists the incident as a smart contract vulnerability with a loss of about $304,500.

What was taken

Based on Etherscan data cited by crypto.news, the attacker withdrew:

About 82.91 ankrETH, worth about $216,370.
About 515,206 ankrPOL, worth about $56,372.
About 7.98 million ANKR, worth about $30,857.
Smaller amounts of aMATICb and aETHb, which had no price on Etherscan and are not counted in the totals.

Security firm Blockaid's first estimate was about $292,000. The later figure of more than $303,000 reflects updated prices for the three priced tokens.

How the attack worked

A cross-chain bridge needs proof that a deposit happened on one chain before it releases funds on another. Here, that proof is a "receipt" signed by a trusted party.

According to the reports, the attacker started from a real but tiny deposit: about 0.0044 ankrETH sent from Optimism on November 3 and redeemed on Ethereum the same day. On November 9, the attacker submitted five new withdrawal requests that pointed to that same old deposit, but with changed details: a different recipient, different tokens and much larger amounts.

SlowMist's summary says all five receipts carried valid signatures from the bridge's trusted signer, which let the withdraw() function release assets without checking them against actual events on the source chain.

What is still unknown

How the attacker got valid signatures. crypto.news said the records do not show how authorization was obtained. A developer quoted by Coin-Turk suggested an administrator key compromise, but that has not been confirmed by Ankr.
Whether the bridge was paused. Reports said the contract's public pause flag still read false shortly after the attack.
Compensation. No plan had been announced when we checked.

We will not guess beyond these reports. Treat the root cause as unconfirmed until Ankr publishes a post-mortem.

Who is affected

Users who rely on Ankr's bridge to move ankrETH, ankrPOL or other Ankr tokens between chains. The Ethereum-side contract lost liquidity, so bridge withdrawals may not be possible until Ankr acts.
Holders of Ankr tokens on Ethereum, indirectly, through market price moves.

Not reported as affected: crypto.news said there was no confirmation that Ankr's RPC infrastructure or users' wallets were compromised. Holding ankrETH in your own wallet is not the same as having funds stuck in the bridge.

What to do now: step by step

Step 1: Do not use the bridge until Ankr confirms it is safe

Wait for an official statement on Ankr's own website or verified accounts before sending anything through the bridge.

Step 2: Check whether you have a pending bridge transfer

If you started a bridge transfer around November 9, find the transaction hash in your wallet and look it up on Etherscan or the source chain's explorer. Note its status and keep the details for any future claims process.

Step 3: Review and revoke bridge approvals you no longer need

If you have approved the Ankr bridge contract to spend your tokens, consider revoking that approval with a trusted approvals tool, such as the one built into Etherscan. There is no report that approvals were abused in this incident, but removing approvals you do not need limits risk. Our guide on how to revoke token approvals after a front-end hijack shows the steps.

Step 4: Keep your liquid staking tokens in your own wallet

If you hold ankrETH or ankrPOL, there is no need to rush them across chains. Leave them in a wallet you control unless you have an urgent need.

Step 5: Watch for official updates only

Follow Ankr's official blog and verified social accounts for a post-mortem or compensation news.

What to avoid

Signing messages or approvals on unknown "recovery" or "claim" pages.
Sending tokens to anyone who promises to recover bridge losses.
Assuming a bridge is safe because its contract is still unpaused.

Lessons for using any cross-chain bridge

This exploit fits a familiar pattern. Bridges hold large pools of locked tokens, and a single weak check can release them. Before using any bridge:

Prefer official, well-reviewed routes and native transfer systems where they exist.
Move only what you need, and do not leave funds waiting in bridge contracts.
Check the bridge's status and recent security news before large transfers.
Limit approvals to the exact amount you are bridging.

For other recent examples and what users did, see our coverage of the Symbiosis Bitcoin bridge exploit, the SingularityNET bridge exploit and the NEAR Intents exploit and cross-chain withdrawals.

Frequently asked questions

How much was stolen in the Ankr bridge exploit?

Reports put the loss at more than $303,000, after an initial estimate of about $292,000 from Blockaid. SlowMist lists it at about $304,500. The stolen tokens were mainly ankrETH, ankrPOL and ANKR.

How did the attacker drain the Ankr bridge?

The attacker reused an old, already-redeemed deposit from Optimism in five withdrawal requests with changed recipient, token and amounts. The requests carried valid signatures from the bridge's trusted signer, so the contract released the funds.

Is my ankrETH in my own wallet safe?

There was no report that user wallets were compromised. The exploit drained the bridge contract on Ethereum. Keep your seed phrase private and avoid using the bridge until Ankr confirms it is safe.

Will Ankr compensate users?

Ankr had not announced a compensation plan or root cause when we checked. Watch Ankr's official channels, and ignore unofficial "refund" sites.

Should I revoke my approvals for the Ankr bridge?

There is no report that approvals were misused here, but revoking approvals you no longer need is a sensible precaution after any bridge exploit. Use a trusted tool such as Etherscan's token approval checker.

Conclusion

The November 9 Ankr bridge exploit drained about $303,000 by passing forged, validly signed withdrawals built on a reused Optimism deposit. The exact cause is still unconfirmed and Ankr had not commented at press time. Keep your tokens in your own wallet, avoid the bridge until Ankr gives an all-clear, tidy up approvals you do not need, and only trust updates from Ankr's official channels.

This article is for information only and is not financial or security advice for your specific situation. The Onchain Support is an independent publication and is not affiliated with Ankr, any bridge, exchange or security firm. We will never ask for your seed phrase, private keys, passwords or 2FA codes. Details reflect the cited sources at the time of writing and may change.

Ankr Bridge Exploit: $303K Drained Using a Reused Optimism Deposit