Ankr’s Ethereum cross-chain bridge was exploited on Nov. 9, 2026, with five unauthorized withdrawal calls draining more than $303,000 in crypto assets. Blockchain security firm Blockaid first detected the ongoing attack and said the attacker reused a tiny Optimism deposit to unlock the bridge’s locked inventory and move funds to a new wallet.
The suspicious withdrawals occurred between 3:09 a.m. and 3:12 a.m. Eastern Time. On-chain data showed the largest transfer was approximately 82.91 ankrETH worth $216,370, followed by 515,206 ankrPOL tokens valued at $56,372 and about 7.98 million ANKR tokens worth $30,857. Two other assets — 5,372.25 aMATICb and 0.8196 aETHb — were also transferred, but their values were not included in the $303,600 estimate because Etherscan did not display prices at the time.
Blockaid said the attacker had deposited just 0.0044024803 ankrETH through Optimism on Nov. 3 and redeemed it on Ethereum the same day. Days later, the same deposit was reportedly referenced in five new withdrawal requests with modified receipt data, larger amounts and different tokens. According to the security firm, between 02:08 and 04:06 UTC several Ankr operator wallets were also drained across Ethereum, Arbitrum and Linea, with funds consolidated into a single wallet used to pay the relayer that submitted the bridge transactions.
At 3:49 a.m. Eastern Time, the bridge’s public pause flag still displayed false, leaving it unclear whether Ankr had halted further activity. The company had not responded to questions about affected services, bridge security or possible user reimbursements by press time. The exploit raises fresh concerns about Ankr’s transaction verification, and follows an earlier August vulnerability in its ankrFLOW contract that caused about $410,000 in losses at MORE Markets.
Other bridge operators have faced similar authorization problems this year, including Cysic’s suspension after 10 million unauthorized CYS tokens were created on BNB Smart Chain, and an XRPL bridge operator losing 198,715.88 XRP from faulty deposit detection logic. For Ankr, the immediate focus remains the drained Ethereum bridge contract and whether additional assets are still at risk.
