---
title: Ankr's Ethereum cross-chain bridge drained of about $300K with five forged withdrawal receipts that carried valid signer signatures | ctxsec
url: https://ctxsec.com/items/ankr-ethereum-bridge-forged-receipts-304k-nov-9
description: "Blockaid flagged an ongoing exploit of Ankr's Ethereum bridge early on Nov 9: an attacker made five withdraw calls that reused one small, legitimate Optimism deposit to release the bridge's locked inventory to a new wallet (about $292K at Blockaid's first count). SlowMist puts the loss at about $304.5K and says each forged receipt changed the recipient, token and amount but still carried a valid signature from the bridge's trusted consensus signer, so withdraw() paid out without checking the receipt against the real source-chain event. SlowMist says the origin of those signatures is still under investigation and signer compromise is not confirmed."
status: "security-vendor on-chain analysis (Blockaid and SlowMist alerts, Nov 9); Ankr had not commented at publication"
published: 2026-11-09
---

> Blockaid flagged an ongoing exploit of Ankr's Ethereum bridge early on Nov 9: an attacker made five withdraw calls that reused one small, legitimate Optimism deposit to release the bridge's locked inventory to a new wallet (about $292K at Blockaid's first count). SlowMist puts the loss at about $304.5K and says each forged receipt changed the recipient, token and amount but still carried a valid signature from the bridge's trusted consensus signer, so withdraw() paid out without checking the receipt against the real source-chain event. SlowMist says the origin of those signatures is still under investigation and signer compromise is not confirmed.

[← Cybersecurity News](/news) · [markdown](/items/ankr-ethereum-bridge-forged-receipts-304k-nov-9.md)

security-vendor on-chain analysis (Blockaid and SlowMist alerts, Nov 9); Ankr had not commented at publication

2026-11-09

### Ankr's Ethereum cross-chain bridge drained of about $300K with five forged withdrawal receipts that carried valid signer signatures

- **Before the withdrawals:** Blockaid says the attacker swept several Ankr operator wallets on Ethereum, Arbitrum and Linea into one new wallet (roughly 02:08 to 04:06 UTC) and funded the relayer from it.
- **Addresses (per SlowMist):** attacker `0x9A88Dd45AE846A979705c9cFdfD0f229e592D703`, recipient `0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6`, vulnerable contract `0xc437DF90B37C1dB6657339E31BfE54627f0e7181`.
- **Not yet known:** how the attacker obtained valid signatures, and Ankr's own account of the incident.
- If you hold assets bridged through Ankr, watch Ankr's official channels before moving them, and ignore unofficial "recovery" offers.

Sources: [Blockaid on X (Nov 9)](https://x.com/blockaid_/status/2119712260184527262) · [Blockaid: operator-wallet sweeps (Nov 9)](https://x.com/blockaid_/status/2119728818457821402) · [SlowMist TI alert (Nov 9)](https://x.com/SlowMist_Team/status/2119720284093890615)