Forged receipts unlock assets from Ankr’s Ethereum bridge
SlowMist reports five forged receipts used valid bridge signatures and referenced one earlier Optimism deposit. The Ethereum contract paid out five tokens. SlowMist estimates about $304,500. How the signatures were obtained remains under investigation.
- Disclosed
- Nov 9, 2026
- Public disclosure date
- Severity
- Septic Tank Blew
- No CVE: a breach, not a bug
- Splash zone
- Ankr’s Ethereum cross-chain bridge escrow and integrations relying on that withdrawal path.
- Ankr · bridge · Ethereum
- In the wild
- Yes
- SlowMist and OAK report five withdrawals. Signing-key exposure remains unconfirmed.
What happened
SlowMist’s original alert says the bridge accepted five receipts that changed the recipient, token and amount while referring to the same legitimate Optimism transaction. The receipts carried valid consensus signatures. OAK traced withdrawals of ankrETH, ANKR, ankrMATIC, aPOLb and aETHb to one recipient. The dollar figure is SlowMist’s estimate. OAK’s trace provides transaction corroboration and does not establish final net loss or prove signing-key theft. The reviewed material did not establish a vendor remediation, confirmed pause or reimbursement plan.
Published transaction hashes. The first is the legitimate Optimism source event reused by the forged receipts.
0x02e805b51beb4ed39e6a66ffcbdf9060cf008b3c3f0e827d0d357dfa115e7d4a
0x139e3e30b2993b96aec206e168d299d1678cf05a57c58d90593cf6c7b5f6d3e8
0x7310af5d53e08259915bc3547daf343d188b9c36db8dd6b3ff3b5e70565e88df
0x90c563360cc343a640721662abe762e9ab9665aee0c22820b1656ff23bcfc891
0xde2d5b455c0071698fec9c23a9c50f9ecdfd8efa96b4fbb48ed0620bd4c29b5c
0x91ba1a9c81a1bb67ce7a2779d5b2de54b7aece166f67d9e3a31e29e4e13c2886
0x46e20d4c8cd43dece94f7a2a890a348fefcb0dc8310279658c8f836e758bdad0
0x05f3d8109ca5bbc9e4d51697667ba9013dac5a476f1e2c6e695fffdfa2f0368c
0x560715bdd7f6eb59907395f6c6b519c489c2e7d1a13a22580079866a8c0799a8
0x393524106e749e57086c5b67e27cdbfabad4b30087dbe85c11e5b11099ff6bf3
0xfb4288a47f0146a534c17480b9eca017994fa587c25f022b051abb70c8e38e53
0x604820e86bc0eff1c85f4cbc2a4cc34d0c17f7254903e8623776359a8e042b90Crime-scene timeline
Nov 9, 08:09 UTC
Ethereum bridge begins paying the forged receipts
OAK’s trace shows five withdrawals to a single recipient between 08:09:35 and 08:11:59 UTC.
Nov 9, 09:14 UTC
SlowMist publishes its initial analysis
The researchers estimate about $304,500 and identify the reused Optimism transaction and signed receipts.
Nov 10, 2026
OAK traces the Ethereum leg
Its independent transaction trace corroborates the five releases.
Who said what
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.
- SlowMist original technical alert, public copyPrimaryDescribes the forged receipts, valid signatures, reused source transaction and estimated amount.
- OAK original transaction tracePrimaryCorroborates five Ethereum withdrawals and documents evidence limits.