Ankr Ethereum bridge (November 2026) hack — November 2026

Between 08:09 and 08:12 UTC on 9 November 2026 Ankr's cross-chain bridge contract on Ethereum paid out five withdrawals that had no matching deposit. Each receipt pointed at the same Optimism transaction, a legitimate deposit that had already been redeemed, with the recipient, token and amount changed. SlowMist found that all five receipts carried valid signatures from the bridge's trusted consensus signer and that withdraw() released assets without checking them against the source chain. How the attacker got those signatures, and whether the signer was compromised, is still under investigation.

The bridge released 82.91 ankrETH, about 7.98 million ANKR, 515,206 ankrMATIC, 5,372 aPOLb and 0.82 aETHb. Within the next half hour the receiving address sold 77.9 ankrETH and all the ANKR for 103.26 ETH, then sent the ETH on. At ETH prices of about $2,110 at the time, that is about $218,000, plus about $12,600 in the 5 ankrETH still held: $230,700 is the figure recorded here. SlowMist's $304,500 also counts the ankrMATIC, aPOLb and aETHb, which had not been sold and trade thinly, so it is the high end.

No Ankr statement had been found by the end of 9 November, and nothing has been reported frozen or returned. Ankr was previously hit in December 2022 (aBNBc) and through its ankrFLOW contract in August 2026.