Ankr Bridge Exploit Drained Five Tokens In 144 Seconds

The Ankr bridge exploit took 144 seconds on Ethereum. Five withdrawal calls landed between 08:09:35 and 08:11:59 UTC on November 9, 2026, and each one pulled a different token out of the bridge contract. Security firm Blockaid posted about the drain roughly half an hour later and put the loss near $292,000.

We checked the chain ourselves instead of leaning on the tweets. Three calls hit back to back blocks starting at 26,376,043. The other two came in blocks 26,376,052 and 26,376,055. One sender account called the same bridge contract each time, and every token went to one receiving account. Both accounts appear in Blockaid's exploiter list, the sender starting 0x9A88 and the receiver starting 0x119D.

Blockaid says the attacker used a tiny deposit made on Optimism to unlock the bridge's full stock of locked tokens. The firm adds that the same actor swept several Ankr operator accounts on Ethereum, Arbitrum and Linea. Those sweeps ran between about 02:08 and 04:06 UTC, hours before the withdrawals.

Ankr Bridge Exploit, Token By Token

Here is what left, in order. All of it is read from each transaction's transfer logs, with no dashboard in between. The first call took 82.91 ankrETH. The second took 7,982,766 ANKR. The third took 515,206 ankrPOL, the fourth 5,372 aMATICb, and the fifth 0.82 aETHb.

Blockaid's thread on X flagging the drain and naming the bridge. Source: Blockaid on X.

Those amounts match what PeckShield listed in its own alert. Loss estimates still differ because token prices differ by source. PeckShield put the total near $286,000 and Blockaid near $292,000 while the attack was running. At CoinGecko prices on November 9, the 82.91 ankrETH alone is about $210,000 and the ANKR leg about $31,000.

Timing is tight. The Ankr bridge exploit emptied the contract of all five tokens inside two and a half minutes. The attacker needed no pause between the first three.

The gaps are small. The first three came 12 seconds apart. The fourth followed 84 seconds later and the fifth 36 seconds after that. All five were confirmed, with status success.

How Long The Ankr Bridge Exploit Ran Before A Pause

The bridge was not paused while the drain ran. A Paused event on the same contract appears at block 26,376,553, which is 09:51:47 UTC. That is 1 hour 42 minutes after the first withdrawal.

Blockaid noted during the attack that the public pause flag still read false. We read the flag again on November 9 and it now returns true. The five tokens we checked each show a zero balance in the contract.

From the first sweep Blockaid lists to the pause is about seven hours and 43 minutes. Our earlier coverage of an Aave proposal adding a reentrancy guard to 15 deployments shows how other teams harden contracts before an incident, not after.

Anyone who moved tokens through the Ankr bridge should check the contract state first. Then wait for the team's own statement on affected services and any compensation. Two of the tokens drained, ankrETH and ankrPOL, are Ankr's liquid staking tokens. Token prices move quickly and the figures above were taken on November 9. This is a report of public chain data, not financial advice.