Ankr Bridge Attack Used Five Forged Receipts With Valid Signatures

Ankr's cross-chain bridge released assets after an attacker submitted five forged withdrawal receipts bearing valid signatures from trusted consensus signers, exposing a gap in how the system checked activity on the source network.

The attack caused about $304,500 in losses. The receipts all referenced the same legitimate transaction on Optimism, but each altered the recipient, token and withdrawal amount.

All five receipts carried valid signatures, yet the withdrawal function did not independently verify the source-chain event before releasing assets. The function therefore accepted withdrawal details that had not been confirmed against the actual event on the originating network.

The origin of the unauthorized signatures remains under investigation. No compromise of the signers has been confirmed. Optimism was the network tied to the legitimate transaction used in all five receipts. The incident shows that valid signatures alone did not establish that the withdrawal details matched a real source-chain event.