Ankr Ethereum Cross-chain Bridge Exploited for $304,500

Ankr’s Ethereum cross-chain bridge experienced an exploitation incident where the attacker submitted five forged cross-chain receipts. These receipts referenced the same legitimate Optimism transaction but altered the recipient, token, and amounts. The attack was facilitated by the fact that all receipts carried valid signatures from the bridge’s trusted consensus signer, which allowed the withdraw() function to release assets without verifying against actual source-chain events.

The total loss from this incident is approximately $304,500. The specific blockchain involved in this incident is not stated, which limits the ability to trace the movement of the stolen assets on-chain. However, the mechanism of the attack highlights a vulnerability in the verification process of cross-chain transactions, where forged receipts can bypass standard checks.

The on-chain record does not provide specific addresses related to this incident, which further complicates the tracing of the stolen funds. The exploitation of the bridge emphasizes the importance of robust verification mechanisms in cross-chain operations to prevent similar incidents in the future.