Security Breach at Ankr’s Ethereum Bridge Results in Over $303,000 Theft After Exploit of Optimism Deposit

Security Breach of Ankr's Ethereum Cross-Chain Bridge

On November 9, Ankr's Ethereum cross-chain bridge experienced a serious security breach, resulting in over $303,000 worth of cryptocurrency being withdrawn without authorization. This incident raises significant concerns about the effectiveness of the bridge’s transaction verification procedures.

Details of the Exploit

The cybersecurity firm Blockaid reported the exploit, which involved an attacker leveraging a minuscule deposit made on the Optimism network to execute five successful withdrawal transactions from Ankr's bridge. Initially, losses were estimated to be around $292,000; however, further evaluations placed the total amount lost at approximately $303,600. Blockaid classified the event as an ongoing exploit, noting the withdrawals drained various tokens from the Ethereum bridge and transferred them to a newly created wallet used by the attacker.

Withdrawal Transactions

Between 3:09 a.m. and 3:12 a.m. Eastern Time, the attacker initiated five withdrawals, sending multiple assets, including Ankr’s liquid staking tokens and its native ANKR token, all to the same destination wallet. The most significant loss came from 82.91 ankrETH, which alone was valued at around $216,370. Additional assets removed included 515,206 ankrPOL tokens valued at $56,372 and approximately 7.98 million ANKR tokens valued at $30,857. Two other tokens, 5,372.25 aMATICb and 0.8196 aETHb, were transferred, but their values were excluded from the total due to the absence of price data at the time of analysis.

Response and Security Measures

The bridge had paused all transactions by 3:49 a.m. Eastern Time, but it remained uncertain whether Ankr had taken adequate actions to prevent further unauthorized withdrawals since the public pause flag was showing false. Notably, the exploit originated from a deposit made on November 3, which consisted of just 0.0044024803 ankrETH, and had already been redeemed on Ethereum the same day. Yet, on November 9, the attacker submitted five withdrawal requests that included revised receipt details, larger requested amounts, and different tokens than the original deposit.

Concerns About Broader Impact

Ankr’s cross-chain bridge is designed to facilitate the transfer of approved liquid staking assets between various blockchain networks. Under normal circumstances, a deposit transaction should not allow the same assets to be withdrawn multiple times. However, the attacker was somehow able to bypass these security measures, and questions remain regarding how valid authorizations were processed.

Additionally, it is still unknown whether other Ankr products, such as their remote procedure call (RPC) services, were compromised during this incident. Reports state that there is currently no evidence suggesting the exploit had any impact on users' personal wallets or Ankr's wider RPC infrastructure. However, the company has not provided further details on the extent of the breach following inquiries from crypto.news.

Historical Context of Security Issues

This incident is not the first time Ankr has faced security challenges; in August, vulnerabilities in its ankrFLOW contract enabled an attacker to create millions of uncollateralized tokens, costing approximately $410,000. Problems with transaction authorization have been a common issue across various bridge operators this year, with similar incidents reported by others, including Cysic and an XRPL bridge operator, emphasizing the ongoing risks associated with cross-chain transfers and liquidity movements in the crypto space.