Ankr Ethereum bridge loses over $303,000 in five-transaction exploit
Attackers targeted the Ankr Ethereum bridge in five transactions, draining more than $303,000 after smart contract withdrawals failed to pause.
Key takeaways
- 1Attackers stole over $303,000 from the Ankr Ethereum bridge across five transactions on 9 November.
- 2The smart contract failed to pause after processing withdrawals referencing an Optimism deposit that was already redeemed.
Attackers stole more than $303,000 from the Ankr Ethereum bridge in a security exploit executed across five separate transactions on 9 November. On-chain data shows that the bridge protocol failed to automatically pause withdrawals, allowing the attacker to interact with the underlying smart contracts multiple times.
The exploit stemmed from a failure in how the bridge contract validated cross-chain withdrawal requests. The contract remained unpaused after processing withdrawals that referenced a single, small deposit originally made on the Optimism Layer 2 network. Because the contract did not register that the Optimism deposit had already been redeemed, the attacker was able to repeatedly reference the same deposit to extract assets from the Ethereum side of the bridge.
Ankr operates decentralised blockchain infrastructure, offering node services and liquid staking solutions across various blockchain networks, including Ethereum and Optimism. Cross-chain bridges serve as critical infrastructure in the crypto sector by allowing users to transfer value across distinct blockchain networks, typically holding pooled assets in smart contracts to back cross-chain transfers.
Security exploits targeting cross-chain bridges often put pressure on protocol teams to reimburse affected users and upgrade smart contract code. Bridge users and liquidity providers will monitor for an official technical post-mortem from Ankr detailing the mitigation steps and confirming whether smart contract upgrades have fully secured the remaining funds.
Reported and edited by the YourKhabri desk under our editorial policy. Nothing here is investment advice.