Ankr’s Ethereum bridge lost somewhere between $292,000 and $304,500 on November 9. In the arithmetic of 2026 bridge hacks, that is noise. The mechanism is not.

The attacker did not break a signature, drain a hot wallet or phish an operator. According to SlowMist’s alert, five withdrawal receipts were submitted on the Ethereum side, all referencing the same legitimate Optimism transaction, with the recipient, the token and the amounts rewritten. Every receipt carried a valid signature from the bridge’s trusted consensus signer, and the contract’s withdraw function released the assets without checking them against what actually happened on the source chain (SlowMist).

One real deposit. Five exits.

What the public record shows

The facts available so far come from security analysts rather than the operator.

SlowMist describes the root cause as a verification gap: forged receipts with valid signatures, and a withdraw path that did not confirm the corresponding source-chain event. It puts the loss at about $304,500.

The Defiant reported five withdrawals that removed about $303,600 in priced tokens, and added the line that matters most: at a 3:49 a.m. ET check, hours after the first withdrawal, the contract had still not been paused (The Defiant).

An earlier security estimate put the loss nearer $292,000. The spread is pricing method and which tokens were counted, not a disagreement about what happened.

Ankr had not published a post-mortem by the time this was written. The public technical account is SlowMist’s, which means the token-level breakdown and the scope of affected balances are still unknown.

How a lock-and-unlock bridge is supposed to work

Ankr Bridge exists to move Ankr’s liquid staking tokens between networks while the underlying stake keeps earning. Its own documentation describes the design honestly: most bridges mint and burn wrapped assets, but for already-pegged tokens you need a lock-and-unlock scheme, which obliges the operator to rebalance liquidity between networks (Ankr docs).

The bridge was audited by Beosin. That is not a criticism of the audit. It is a reminder of what audits cover: code as written, against known bug classes, at a point in time. Whether an operator watches the pause button at 3 a.m. is not in scope.

In a lock-and-unlock bridge the whole security model collapses into one question: on release, does the contract verify the source-chain event, or does it verify the messenger?

Verifying the messenger is cheaper. You trust a signer, the signer attests to deposits, and the contract pays out when the attestation arrives. Most of the time this is fine, because the signer is honest software relaying real events. The failure mode is not the signer lying. It is the release logic accepting any well-formed statement signed by that signer, including a statement about an event that has already been redeemed, or one whose details were rewritten in transit.

That is what “forged receipts with valid signatures” describes.

Why a signature proves less than it seems

A signature answers exactly one question: who said this.

It does not answer whether the thing said is true, whether it is the first time it has been said, or whether the numbers match the event. Those require looking at the other chain, and looking costs gas, latency and engineering.

Every bridge incident in this class comes down to the same missing check, expressed in different code. Has this source event been consumed before? Does the amount on the receipt equal the amount in the deposit? Is the recipient the same address that deposited? Is the token the same token?

When those checks live off-chain in an operator’s process, they are only as good as the process. When they live on-chain, they cost a storage slot and a require statement. The gap between those two designs is where the 2026 bridge losses keep accumulating.

There is also a category error worth naming, because it shows up in the coverage of every incident like this. Analysts price the loss from the tokens that moved. The attacker’s profit may be smaller, since the drained assets have to be sold into liquidity. The protocol’s damage may be larger, because the same collateral backed claims elsewhere. One number, three meanings.

The pause flag that stayed unset

The dollar figure is a footnote. The response window is the story.

A pause mechanism exists precisely so a drain can be stopped in minutes. It is not a difficult feature to build. It is difficult to staff: someone has to be watching, someone has to have authority to act, and someone has to be reachable at 4 a.m. on a Sunday.

Hours of an unset pause flag, on a drain visible on-chain to anyone with an explorer, tells you more about operational readiness than the audit report does. It also tells you what the next attacker learns: the contract may be the least of it.

For users, the practical translation is unflattering. You cannot audit an incident response team. You can only observe its behaviour after the fact, and then decide whether to keep assets in a system whose failure mode is measured in hours.

What holders should do

Watch the backing question, not the price. If the Ethereum side of the bridge is short collateral, the tokens it backs may trade below peg until the shortfall is covered. That is the on-chain consequence that matters to anyone holding bridged liquid staking tokens.

Do not bridge more into the affected contract until there is a post-mortem with a scope statement. “We are investigating” does not tell you which balances are whole.

If you hold bridge-wrapped assets you do not need immediately, the decision is the same one every bridge incident pushes toward: either accept the operator risk with the position sized accordingly, or move to a venue where the collateral question has a public answer.

And if you are the operator of a bridge: the check that would have stopped this is not novel, and the runbook that would have stopped it is not expensive. Both exist in public post-mortems going back to 2022. Repeated failure to implement them is a choice.

What is still unknown

Which tokens left the bridge, in what amounts, and at what addresses. Whether the drained funds have moved. Whether the pause has since been set, and whether the flaw is closed or merely unplugged. Whether Ankr will publish an incident report, and whether it will cover the shortfall.

The one number that will not change is five: five receipts, one deposit, one signature domain trusted enough to release funds.

Sources

Frequently Asked Questions

What is a forged receipt attack?

A lock-and-unlock bridge holds assets on one chain and releases them on another when someone proves the matching deposit happened. That proof is usually a receipt signed by a trusted signer or oracle. A forged receipt attack does not break the signature. It makes the bridge accept a receipt for an event that already happened, or never happened in the form described, and pays out on it. Here the attacker used one real Optimism deposit as the base for five withdrawals.

If the signatures were valid, how were the receipts fake?

A signature proves who attested to something, not that the underlying event is true, unique or unspent. SlowMist's description says the forged receipts altered the recipient, token and amounts while keeping valid consensus-signer signatures, and that withdraw() released assets without verifying against actual source-chain events. When the release logic trusts the attestation and skips the cross-check, a valid signature becomes a permission slip for whatever is written next to it.

How much was lost, and which tokens?

Estimates range from about $292,000 in an early security analysis to about $303,600 on-chain pricing to SlowMist's $304,500. The discrepancy is mostly pricing and which tokens are counted. Ankr has not published the token-level breakdown, so treat any exact figure as provisional. The bridge in question is the Ethereum side of Ankr Bridge, which carries Ankr liquid staking tokens such as ankrETH between networks.

Are my ankrETH or Ankr staking balances affected?

The loss came out of assets held by the bridge contract, not from every Ankr product. Whether you have exposure depends on whether your tokens sat in the bridge's locked collateral rather than in staking. Ankr has not published a scope statement, so check the official channel before assuming either way, and do not bridge more liquid staking tokens until there is a post-mortem.

Could the wrapped tokens depeg?

That is the risk to watch. If locked collateral on the Ethereum side was drained, the tokens representing it may trade below peg until reserves are topped up or the shortfall is covered by Ankr. A depeg, if it happens, is the clearest on-chain signal for holders. The dollar amount is small; the backing question is not.

What is the lesson for other bridges?

Two checks that cost little. First, a release must verify the source-chain event, not just the attestation: does this deposit exist, is it final, and has it already been consumed. Second, a pause switch needs a person and an alert with a phone number attached, because several hours of an unwatched drain is a bigger failure than a six-figure loss.