Blockchain security firm SlowMist published its analysis of a cross-chain bridge exploit on November 9, 2026, reporting that Ankr’s bridge lost approximately $304,500 to an attacker who submi
Blockchain security firm SlowMist published its analysis of a cross-chain bridge exploit on November 9, 2026, reporting that Ankr’s bridge lost approximately $304,500 to an attacker who submitted five forged withdrawal receipts, all of which carried valid signatures from the bridge’s own trusted consensus signer.
The figure surpassed an earlier $292,000 estimate from security firm Blockaid, with SlowMist’s later analysis incorporating more complete pricing data. The gap between the two estimates underscores how fast post-mortem figures can shift in the hours after an exploit. For related coverage, see Rialto Protocol Overview: Reported Features, Referral Terms and Airdrop Risks.
SlowMist published its findings at approximately 09:14 UTC, flagging the Ankr cross-chain bridge on Ethereum as the target. The five forged receipts all traced back to a single legitimate Optimism transaction, originally involving just 0.0044024803 ankrETH deposited on November 3, 2026, a transaction that had already been redeemed six days before the attack. Context on this theme: Top Crypto Prop Trading Firms in 2026.
Estimated bridge loss $304,500 SlowMist’s reported total loss in the Ankr bridge exploit.SlowMist identified the receiving address as the attacker and reported total withdrawals valued at approximately $304,500 from a recycled, already-redeemed transaction.
The assets drained across the five withdrawals included approximately 82.91 ankrETH, 515,206 Polygon staking tokens, 7.98 million ANKR tokens, 5,372.25 aPOLb, and 0.8196 aETHb, according to CoinInsider’s breakdown of the attack. All five withdrawals were directed to the same receiving address.
The entire sequence ran from 08:09:35 to 08:11:59 UTC, a window of roughly two minutes and twenty-four seconds. Bridge withdrawals were not paused until 09:51:47 UTC, approximately 100 minutes after the first unauthorized withdrawal cleared.
SlowMist alleged that five forged cross-chain receipts passed the bridge’s signature verification. According to SlowMist, each receipt carried what appeared to be a valid signature from the bridge’s trusted consensus signer, allowing the bridge’s withdraw() function to release assets without independently confirming that the underlying Optimism transactions had actually occurred.
Forged withdrawal receipts 5 SlowMist alleged that five altered receipts bypassed replay protection and enabled the withdrawals.According to SlowMist’s findings, the bridge’s replay protection only blocked identical proof submissions. SlowMist alleged that altered receipt contents, including the recipient address, token type, and amount, generated five distinct proof hashes that cleared without triggering the duplicate-submission guard, as also reported by TechFlowPost.
This is not a novel attack class. The design flaw, trusting a consensus signer’s signature without verifying the source-chain event, has appeared in other cross-chain bridge incidents. SlowMist has previously documented similar signing vulnerabilities, including in its analysis of the FlashLoopAdapter flaw that drained two Safe wallets and in its report on the Liquid Network exploit that minted 3,998 L-BTC.
As of SlowMist’s publication time, the source of the unauthorized signatures remained under investigation. Whether the bridge’s consensus signer keys were compromised from outside or whether the signing came from another vector had not been confirmed. SlowMist flagged this as an open question, and Ankr had not released an official post-mortem at time of reporting.
The ANKR token was trading at $0.003942 at the time of the exploit, with a market cap of approximately $39.42 million and 24-hour trading volume around $6.4 million, according to CoinGecko data. The token posted a modest 1.05% gain on the day, though that figure predates the full market digestion of the incident.
The broader crypto market was sitting in Fear territory, with the Fear & Greed Index at 29 out of 100 on the day of the exploit. The Ankr incident was drawing coverage across multiple outlets by mid-morning UTC.
Ankr has not confirmed a recovery plan. With bridge withdrawals paused and the signing source still under investigation, the question hanging over the project is whether this was an external key compromise, an insider event, or something else entirely. The answer will determine whether users can trust a resumed bridge, and SlowMist’s investigation appears to be ongoing.
Editorial credits
LM Lucas Mercer Duty editor · TheCCPress Monitors published articles around the clock and can correct or withdraw them.Checked by TheCCPress QC Team before publishing on November 9, 2026 for cause-and-effect claims, counter-evidence, labeling, headline accuracy, factual consistency, metadata and authorship claims: our AI review system checks every article before it goes live, and our duty editor monitors it after publication. Report an error.
TheCCPress uses AI for research, drafting and review. Our editorial team is responsible for every article and corrects or withdraws articles when needed. How we review.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
The article SlowMist Reports $304,500 Ankr Loss From Five Allegedly Forged Submissions first featured on theccpress.com.
