Five Transactions Drain Over $303,000 From Ankr's Ethereum Bridge

Five exploit transactions drained more than $303,000 from Ankr's Ethereum bridge, according to on-chain records of the incident. The withdrawals referenced a small deposit on Optimism that had already been redeemed. The bridge contract remained unpaused after the five transactions completed.

The figure — above $303,000 across five transactions — represents the aggregate loss from the exploit activity. The mechanics matter as much as the sum. The affected service was Ankr's Ethereum bridge, while the deposit referenced by the fraudulent withdrawals sat on Optimism, the Layer 2 network that runs alongside Ethereum mainnet.

What do the transaction details show?

The sequence, as described in the on-chain record, followed a specific pattern:

• A small deposit existed on Optimism.
• That deposit was redeemed.
• Five withdrawal transactions subsequently referenced the same, already-redeemed deposit.
• The five withdrawals together extracted more than $303,000 from Ankr's Ethereum bridge.
• The bridge contract was never paused during or after this activity.

The core failure appears to sit in the reconciliation between the two chains. A properly functioning bridge should reject any withdrawal that references a deposit already spent. Here, the redemption on Optimism did not invalidate the deposit as a withdrawal reference on the Ethereum side, and the gap between the two states allowed the five transactions to proceed.

Why does the unpaused contract matter?

The contract's unpaused status stands out in the incident record. Bridge operators typically pause contracts within minutes of detecting anomalous withdrawals, because pausing halts further drainage while engineers investigate. In this case, the five transactions completed against a contract that remained live.

That detail carries two operational implications. First, the loss window stayed open after the initial transactions — nothing in the record indicates a manual circuit breaker fired. Second, any user funds still routed through the bridge faced continued exposure until the operator intervened by other means or the exploit conditions were exhausted.

The scale of the loss — just over $303,000 — is modest by bridge-exploit standards, where incidents have historically run into nine figures. The pattern, however, resembles a class of vulnerability specific to cross-chain infrastructure: replay or reuse of deposit references across chains, where a state change on one network fails to propagate to the validating logic on the other.

What happens next?

For Ankr, the immediate operational questions are whether the deposit-reference validation on the Ethereum bridge has been patched, whether additional deposits remain redeemable more than once, and whether affected users will be made whole. The record as it stands documents the five transactions, the $303,000-plus loss, the Optimism deposit link and the unpaused contract — it does not yet document a remediation, a repayment or a post-mortem from the protocol.

Cross-chain bridge operators face continued scrutiny on exactly this failure mode, and incident responses in this category now typically arrive within days, not weeks.