Ankr Ethereum Bridge Loses About $303,600 in Five-Withdrawal Exploit

Crypto News

Ankr Ethereum Bridge Loses About $303,600 in Five-Withdrawal Exploit

Topics in article

Ethereum

An attacker withdrew five types of tokens from Ankr's Ethereum bridge on Nov. 9, with three of them valued at about $303,600. The withdrawals referenced a small Optimism deposit that had already been redeemed. The bridge's pause flag still read false, leaving containment unconfirmed.

An attacker withdrew five types of tokens from Ankr's Ethereum cross-chain bridge on Nov. 9. Three of those assets were valued at about $303,600, based on onchain records and The Defiant's calculation using Etherscan prices.

The five successful withdrawals sent the tokens to the same wallet between 3:09:35 a.m. and 3:11:59 a.m. ET. Security firm Blockaid reported an "ongoing exploit" at 3:42 a.m. ET, saying the attacker had used a small Optimism deposit to unlock the bridge's inventory.

What the attacker took

The transfers included Ankr's staked ETH and POL tokens, its ANKR token, and the aMATICb and aETHb staking tokens. The dollar estimate sums Etherscan's displayed values for ankrETH, ankrPOL and ANKR at 3:46 a.m. ET. It excludes the two tokens without quoted prices and is not a measure of realized sale proceeds.

Etherscan showed $216,369.80 in withdrawn ankrETH, $56,372.32 in ankrPOL and $30,857.30 in ANKR.

Withdrawals referenced an already-redeemed deposit

Ankr's documentation describes a bridge that moves liquid-staking tokens between networks. Users deposit on one network, submit the transaction to Ankr's backend for notarization, then withdraw on the destination network.

All five withdrawals referenced the same Nov. 3 Optimism transaction, which deposited just 0.0044024803 ankrETH for transfer to Ethereum. That amount had already been withdrawn on Ethereum on Nov. 3.

The new withdrawal calls supplied altered receipt data naming a different recipient and larger amounts, with different output tokens. The deployed implementation requires authorization from the bridge's designated signer before releasing funds. The records establish that the withdrawals passed that check, but do not establish how the attacker obtained accepted authorization.

At 3:49 a.m. ET, the bridge's transaction list showed no subsequent transaction, no ETH balance and $0 in priced Ethereum token holdings. Its public pause flag still read false.

Source: The Defiant

Trading involves risk.

Author

PrimeXBT

Our Editorial Team consists of leading experts with a proven record in the fields of trading, cryptocurrencies, blockchain and finance. We thoroughly research the sources of information in order to provide readers with quality content that serves edu...

Read author’s articles

Risk Disclaimer

Disclaimer: Some past publications may be outdated. We recommend following our news to stay up to date with the latest information. For any questions, feel free to contact our support team via the chat below.
The content provided here is for informational purposes only. It is not intended as personal investment advice and does not constitute a solicitation or invitation to engage in any financial transactions, investments, or related activities. Past performance is not a reliable indicator of future results.
The financial products offered by the Company are complex and come with a high risk of losing money rapidly due to leverage. These products may not be suitable for all investors. Before engaging, you should consider whether you understand how these leveraged products work and whether you can afford the high risk of losing your money.
The Company does not accept clients from the Restricted Jurisdictions as indicated in our website/ T&C. Some services or products may not be available in your jurisdiction.
The applicable legal entity and its respective products and services depend on the client’s country of residence and the entity with which the client has established a contractual relationship during registration.