Key Takeaways:
- Blockaid reports that about $292,000 were stolen from Ankr’s Ethereum bridge through five suspicious withdrawals.
- The attacker is said to have used a small Optimism deposit to withdraw several assets.
- Several Ankr operator wallets across three different networks were drained and merged into a single wallet days before the exploit.
Hackers exploited Ankr’s Ethereum Cross Chain bridge with five unauthorized withdrawals. Blockchain security firm Blockaid detected the activity on November 9, 2026, and warned that the attack was still ongoing when it published its alert.
🚨Blockaid detected an ongoing exploit on @ankr on Ethereum.
An attacker submitted five withdraw calls on Ankr’s Ethereum cross-chain bridge, using a tiny Optimism deposit to unlock the bridge’s full locked inventory to a new wallet.
~$292k drained from the bridge so far across ~5 txs. Attack still ongoing. 🧵— Blockaid (@blockaid_) November 9, 2026
The incident points to the concern about how the bridge verifies the cross-chain transaction and grants asset releases.
One Optimism Deposit Linked to Five Withdrawals
Blockaid states that the attacker made 5 withdrawal calls on the Ankr’s Ethereum bridge. Those transactions reportedly involved depositing a small amount from Optimism to unlock assets from the Ethereum bridge contract.
The company estimated it lost about $292,000 in total in about five transactions. The money was moved to the withdrawing wallet in a new wallet address. It was not a single asset, it was multiple assets. These included Ankr-related liquid staking tokens and ANKR, Ankr’s native cryptocurrency.
Usually, a cross-chain bridge will unlock assets on a different chain following a deposit on the originating chain. If it has the same transaction as evidence of authorisation for another withdrawal, a single deposit might potentially be used more than once.
But Blockaid’s first alert failed to detail the exact technical flaw or how the attacker got past the authorization controls on the bridge.
Read More: Initia Halts L1 and Rollups After $2.7M Exploit Tied to Unauthorized Token Minting
Ankr Operator Wallets Were Swept Before the Attack
The on-chain activity that led up to the withdrawals also contributes to the occurrence. The Blockaid reported that between the time of 02:08 and 04:06 UTC, several Ankr operator wallets were emptied throughout Ethereum, Arbitrum and Linea. The money was deposited to a single consolidation wallet.
Next, the attacker transacted with this wallet to pay the fee for the relayer that submitted the transactions to the bridge.
It appears the attacks were executed after the attacker prepared the transaction infrastructure. But only the wallet moves don’t show how access to the operator wallets obtained and if their private keys breached.
Five Transactions Targeted the Ethereum Bridge
Blockaid found two exploit addresses and provided an example transaction with the exploited bridge contract.
All of the withdrawals were towards the same Ethereum Bridge, capital was sent to the attackers’ withdrawal wallet. The reported loss is for the money drained when Blockaid warned, not a final tally of the incident.
That’s significant because the attack continues to be active, even during the time of the alert sent by the security firm. The ultimate losses could be impacted by additional transactions and/or price adjustments for tokens.
The incident puts cross-chain verification under scrutiny. Bridges depend on reliable communication between networks, and their security relies on correctly validating deposits, messages, and withdrawal authorizations.
A failure in any part of that process can expose assets held in bridge contracts, even when the original deposit is legitimate.
Read More: Binance Reveals How Hackers Moved $6.34B After Breaching Its Wallet-Signing System
