SlowMist Says Ankr Cross-Chain Bridge Attack Involved Five Forged Receipts with Valid Signatures
BIBIBI
AT A GLANCE
SlowMist said that the Ankr cross-chain bridge attack exploited five forged receipts with valid signatures, causing a loss of approximately 304500 USD.
Article
SlowMist: All Five Forged Receipts in Ankr Cross-Chain Bridge Attack Carried Valid Signatures
BlockBeats News, November 9, blockchain security firm SlowMist published a report stating that the Ankr cross-chain bridge attack resulted in losses of approximately 304500 USD. The attacker referenced the same legitimate Optimism transaction and submitted five forged cross-chain receipts, modifying the recipient, token, and withdrawal amount. All five receipts carried valid signatures from the bridge's trusted consensus signers, and the withdrawal function released assets without independently verifying the actual events on the source chain. The source of the unauthorized signatures remains under investigation, and it has not been confirmed that the signers were compromised.
Original link: https://m.theblockbeats.info/flash/376317
Key points
01
SlowMist stated that the Ankr cross-chain bridge attack caused approximately 304500 USD in losses.
02
The attacker referenced the same legitimate Optimism transaction and submitted five forged cross-chain receipts.
03
The attacker modified the payee, token, and withdrawal amount.
04
All five receipts bear valid signatures from trusted consensus signers of the cross-chain bridge.
05
The withdrawal function released assets without independently verifying the actual events on the source chain.
06
The source of the unauthorized signature is still under investigation, and it has not yet been confirmed that the signer was compromised.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
Cross-chain bridges typically process withdrawals on another chain based on source chain events and signatures. In this incident, the attacker submitted five modified receipts; these receipts carried valid signatures, and the withdrawal function did not independently re-verify the events that actually occurred on the source chain, so the assets were released.
Why it matters to readers
This incident shows that relying solely on valid signatures without independently verifying source chain events may fail to prevent forged receipts from triggering withdrawals.
Using a cross-chain bridge means that asset handling relies on the bridge's signing and verification mechanisms; beginners should pay attention to relevant security announcements and investigation progress.
Risks and unknowns
Where the unauthorized valid signature came from is still under investigation.
It has not yet been confirmed whether the trusted consensus signers have been compromised.
The original text does not state whether the vulnerability has been fixed or whether withdrawals have been suspended.
The original text does not specify whether the lost funds can be recovered or will be compensated.
Related Developments
Loading event timeline…
Related concepts
Cross-Chain Bridge
A tool that connects different blockchain networks and supports cross-network token transfers or communication.
