Ankr Hack

In November  9th 2026, cross-chain infrastructure provider Ankr suffered a security breach resulting in approximately $304,500 in losses. The attack exploited a receipt-validation flaw where the bridge processed forged cross-chain withdrawal receipts bearing valid signatures from a trusted consensus signer without independently checking them against actual source-chain events.

The attacker submitted five separate fraudulent cross-chain withdrawal transactions referencing a single legitimate Optimism transaction (0x02e805b5...). By altering the recipient address, token type, and withdrawal amounts while keeping valid signatures from the bridge's consensus key mechanism, the attacker bypassed verification logic in the vulnerable target contract (0xc437DF90...). This allowed the withdraw() function to release assets to the attacker's designated recipient address (0x119D250b...) multiple times using the same reused source context.

SlowMist’s investigation noted that while the receipts carried genuine consensus signatures, the exact origin of those signatures remained under active review, with signer key compromise still unconfirmed at the time of reporting.

Attacker / Tx Sender Address: 0x9A88Dd45…92D703

Beneficiary Recipient Address: 0x119D250b…7a1Aa6

Vulnerable Bridge Contract: 0xc437DF90…0e7181

Exploit Transaction Hashes:

0x7310af5d…5e88df

0x90c56336…cfc891

0xde2d5b45…c29b5c

0x91ba1a9c…3c2886

0x46e20d4c…8bdad0