The Ankr cross-chain bridge fell victim to a targeted attack, as a result of which the attacker managed to withdraw crypto assets worth about $304,500. The incident exposes a fundamental problem of trust in transfer confirmation mechanisms in multi-chain infrastructure.
According to blockchain security analysts, the hacker employed a sophisticated exploitation technique: they used a previously processed transaction on the Optimism network as a template to generate five fake transfer confirmations. In each of them, the recipients, tokens, and amounts were altered, yet the confirmations themselves contained valid signatures of the bridge's trusted participants. This is precisely what allowed the check to be bypassed and the funds to be successfully withdrawn via Ethereum.
The key detail of the incident is that the source of these signatures has still not been established. This means that either the validators' private keys were compromised, or the attacker found a way to reuse legitimate signatures from past operations, which points to an architectural flaw in Ankr's verification logic.
Such attacks on cross-chain bridges remain one of the most acute threats to the DeFi sector. Bridges accumulate significant volumes of liquidity while often relying on a limited set of trusted signers, creating a centralized point of failure. The Ankr case demonstrates that even valid cryptographic signatures do not guarantee security if there is no reliable binding of the signature to the context of a specific transaction.
Cryptalist analysis: The incident highlights the systemic vulnerability of the trusted-signer model that dominates the architecture of cross-chain bridges. The market needs a transition to cryptographically verifiable schemes with signatures bound to the unique state of a transaction, as well as stricter auditing of the logic for reusing confirmations. Until then, bridges will remain a priority target for attackers, and the aggregate risk to liquidity in the multi-chain ecosystem will remain at a high level.