Ankr-ETH bridge exploit drains about $292K, security firms warn

A vulnerability in the bridge between multichain infrastructure platform Ankr and the Ethereum chain has exposed roughly $292,000 in losses, blockchain security firm Blockaid said. According to Blockaid, the attacker submitted five withdrawal requests to Ankr’s Ethereum cross-chain bridge, deposited a small amount on Optimism, and then withdrew all assets locked in the bridge to a new wallet. Assets worth about $292,000 have been drained through five transactions so far, and the attack is still ongoing, Blockaid warned. SlowMist added that the attacker submitted forged cross-chain receipts that referenced the same legitimate Optimism transaction while changing the recipient address, token type and withdrawal amount. All five receipts included valid signatures from consensus signers trusted by the bridge, allowing the withdraw() function to release assets without separately cross-checking and verifying the receipts against events that actually occurred on the source chain, according to SlowMist.