Blockaid Puts Ankr Ethereum Bridge Attack Losses at $292,000

Security firm Blockaid says an ongoing attack on Ankr's Ethereum cross-chain bridge has drained roughly $292,000. The firm labeled the incident active at the time of its reporting, with the attacker's funds already consolidated across multiple networks and moved through a relayer address.

The core of the exploit is mechanical and unusually clean. The attacker deposited a small amount on Optimism, then used that position to trigger withdrawal calls on Ethereum. Blockaid counted five such calls. Those five calls unlocked every asset the bridge held at the time and pushed the entire balance to a newly created address, according to the firm's on-chain analysis.

In other words, this wasn't a partial drain. The bridge's Ethereum-side holdings were emptied in a single sequence, and the total haul came to approximately $292,000 — a figure Blockaid described as an estimate while the attack was still underway.

What happened before the withdrawal calls?

The pre-attack preparation is where the incident gets broader. Blockaid said that several hours before the Ethereum withdrawals executed, assets from multiple Ankr operator wallets on three networks — Ethereum, Arbitrum and Linea — were consolidated at an address beginning 0x4Ea.

Funds from that 0x4Ea address were then sent onward to a relayer address, Blockaid reported. A relayer typically sits in the middle of cross-chain messaging flows, relaying proofs or instructions between chains, which makes the routing noteworthy for anyone tracing where the assets are heading.

The full sequence therefore spans four chains: Ethereum, Arbitrum, Linea and Optimism. Operator-wallet assets were gathered first across the first three, then the bridge calls fired on Ethereum, unlocked by the small Optimism-side deposit.

What does this mean operationally for Ankr?

Two distinct threads run through Blockaid's findings, and they may or may not be the same actor. The first is the bridge exploit itself: a small Optimism deposit that somehow authorized the release of all locked Ethereum-side assets. The second is the movement of assets out of Ankr operator wallets on three networks hours earlier.

If the operator-wallet movements were part of the same operation, that points to a compromise that reached inside Ankr's own infrastructure rather than a pure smart-contract flaw. Blockaid's data shows the consolidation and the bridge drain as sequential steps in one timeline, several hours apart, with funds ending at a relayer address.

Ankr operates cross-chain infrastructure, and a bridge that can be fully emptied by five calls tied to a minimal deposit has a message-verification problem at minimum — the Ethereum side accepted withdrawal instructions that the Optimism-side deposit shouldn't have justified at that scale.

What should users watch now?

The dollar figure is modest by exploit standards, but the pattern matters more than the total. A full drain of bridge-held assets, preceded by multi-network operator-wallet consolidation, is the kind of sequence that usually prompts a pause on bridge operations, a post-mortem from the protocol, and possibly a coordinated freeze request to exchanges receiving the flagged funds.

Blockaid said the attack remained underway and losses stood at roughly $292,000. Watch for Ankr's response and any confirmation of whether the operator wallets were compromised directly or whether the bridge's verification logic failed first.