Ponte Ethereum da Ankr · Breach

[Single source] Forged receipts drain $304,500 from Ankr's Ethereum bridge

Nov 10, 2026 · 1 min read

SlowMist reports about $304,500 lost from Ankr's Ethereum bridge after five forged withdrawal receipts reused one Optimism transaction. Blockaid independently flagged the exploit. How the unauthorized receipts obtained valid signatures remains unresolved.

By HIFY Radar newsroom Updated 11/10/2026 07:10 AM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

The latest: SlowMist says about $304,500 left Ankr's Ethereum bridge after five forged withdrawal receipts, meaning proof messages a bridge accepts in order to release funds, were all built by reusing a single legitimate Optimism transaction. Blockaid separately flagged the same exploit. Nobody has yet explained how those forged receipts carried valid signatures.

What happened

Alleged

According to SlowMist's report, five withdrawal receipts were submitted to Ankr's Ethereum bridge that did not correspond to five separate real deposits. Each one allegedly reused a single genuine transaction on Optimism, and the bridge paid out roughly $304,500 in total.

Observed

DailyDarkWeb relayed the findings on X and noted that security firm Blockaid flagged the exploit independently. So the incident now rests on two detection teams pointing at the same event.

Why it matters

Inferred

Bridges pool user funds and depend on checking signed receipts from other chains. If one valid message can be replayed as multiple payouts, a single approved withdrawal effectively becomes several, and the damage scales with how much the bridge holds.

Inferred

The unresolved detail is the part that should worry other bridge operators. If the forged receipts carried genuinely valid signatures, the failure may sit in key management or in how signatures get verified, not only in a missing replay check.

What to do

Inferred

If you have used Ankr's Ethereum bridge, wait for an official statement from Ankr or SlowMist before assuming funds are safe or gone, and hold off on large new deposits until the signature question is answered.

Inferred

Also be wary of unsolicited refund offers tied to this incident. Recovery scams routinely follow public hacks, and no legitimate recovery process has been announced in the current reporting.

Confirmed and still uncertain

Observed

Reported so far: about $304,500 in losses, five forged receipts, one reused Optimism transaction, and an independent flag from Blockaid. All of it traces back to SlowMist's account of the incident.

Observed

Still unknown: how the forged receipts obtained valid signatures, who was behind it, whether any funds can be frozen or recovered, and whether anything beyond the Ethereum side of the bridge was affected. The SlowMist tracking entry in this batch adds no detail on any of those points.

What people are saying

Observed

DailyDarkWeb summarized the incident on X: about $304,500 gone, five forged receipts reusing one Optimism transaction, Blockaid flagging the exploit independently, and the signature question left open.

Observed

SlowMist's public hacked database carries the incident in its bridge category, and that tracking page is where the primary record currently lives. No statement from Ankr appears in this batch.

Evolution

Inferred

The picture formed in two steps. SlowMist's report put a number and a mechanism on the incident, then Blockaid's independent flag gave the exploit a second detection signal. What has not moved at all is the core question of how the receipts got valid signatures in the first place.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

In plain terms, a cross-chain bridge releases money when it verifies a signed receipt proving a deposit happened on the other chain. SlowMist's claim is that five forged receipts all leaned on one real Optimism transaction, so the same proof was effectively cashed in five times.

Inferred

That points to two very different failure modes: a missing replay guard, which would let a real receipt be reused, or valid signatures ending up in the wrong hands, which would explain forged receipts passing checks. Nothing in the current evidence says which one happened.

Sources and evidence

Observed

This story rests on two items: SlowMist's bridge hack tracking page and a DailyDarkWeb post on X that summarizes it and credits Blockaid as an independent flagger. There is no on-chain trace, no attacker attribution, and no Ankr statement in the batch, so every number and mechanism above is only as strong as those two sources.