[ctx]ctxseccontext security: attacks on the harness and context layer of AI agents, plus exploited-now news, hunting and playbooks.

← Cybersecurity News · markdown

security-vendor on-chain analysis (Blockaid and SlowMist alerts, Nov 9); Ankr had not commented at publication

Ankr's Ethereum cross-chain bridge drained of about $300K with five forged withdrawal receipts that carried valid signer signatures

  • Before the withdrawals: Blockaid says the attacker swept several Ankr operator wallets on Ethereum, Arbitrum and Linea into one new wallet (roughly 02:08 to 04:06 UTC) and funded the relayer from it.
  • Addresses (per SlowMist): attacker 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703, recipient 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6, vulnerable contract 0xc437DF90B37C1dB6657339E31BfE54627f0e7181.
  • Not yet known: how the attacker obtained valid signatures, and Ankr's own account of the incident.
  • If you hold assets bridged through Ankr, watch Ankr's official channels before moving them, and ignore unofficial "recovery" offers.

Sources: Blockaid on X (Nov 9) · Blockaid: operator-wallet sweeps (Nov 9) · SlowMist TI alert (Nov 9)