An attack on Ankr’s cross-chain bridge caused about $304,500 in losses after it released assets without confirming that the withdrawal details matched the Optimism event behind them.
All five withdrawal requests cited one legitimate transaction on Optimism but specified different recipients, tokens and amounts. All five receipts carried signatures that passed the bridge’s trusted consensus signer check, allowing the requests through.
Ankr’s withdrawal function treated the signatures as sufficient to release the assets. It did not compare each payout with the Optimism event before processing the request.
The attack exposed a gap between checking a receipt’s authenticity and confirming its payout against the source network. Investigators have not determined how the unauthorized signatures were produced, and no compromise of the trusted consensus signers has been confirmed.
