Ankr bridge incident: five releases and the limits of the onward trace

On November 9, 2026, five successful calls to Ankr’s Ethereum bridge released five token positions to one recipient within a window of two minutes and 24 seconds. The subsequent record describes conversion through MetaMask Swaps, an ETH transfer to a consolidation address, and deposits to an address labeled Tornado.Cash Router.

The sequence is more specific than a headline loss estimate. It identifies the bridge, the signer, the beneficiary and the onward route. It does not establish the precise authorization failure, identify the people controlling the addresses, or link mixer withdrawals to an eventual recipient. Several quantities in the onward narrative remain unverified and should not be treated as confirmed loss or recovery figures.

This analysis covers the November Ethereum incident, not the separate August ankrFLOW/Flow case. All times below are UTC. The underlying report is dated November 11, 2026, with data retrieved at approximately 01:42–01:44 UTC.

Five releases in a narrow window

The report identifies the relayer as the signer of five zero-native-value calls to the bridge between 08:09:35 and 08:11:59. Zero native value describes the calls’ ETH value; it does not mean no token value left the bridge. Each call released one token position to the same recipient.

The release register records:

• 08:09:35, block 26376043: 82.911105628282457579 ankrETH. The source decodes log 867 as a Transfer from the bridge to the recipient, with a raw value of 82911105628282457579 wei.
• 08:09:47, block 26376044: 7,982,766.478492331 ANKR.
• 08:09:59, block 26376045: 515,206.25574139773 aMATICc.
• 08:11:23, block 26376052: 5,372.248765839372 aMATICb.
• 08:11:59, block 26376055: 0.819623228838796 fETH.

The final four quantities are transfer-screen values at display precision. Their signer, called contract, blocks and times are taken from the relayer’s transaction list. These asset amounts stay in their own units: adding ANKR, ankrETH and the other tokens would not produce a meaningful aggregate.

Figure 1. Five bridge releases, November 9, 2026. The timeline shows recorded UTC timestamps rather than a valuation comparison. Source: PDF pp. 4–5.

Conversion did not move every asset

The source describes swaps beginning at 09:12:11, after the last bridge release. It records all the received ANKR and most of the received ankrETH being routed through MetaMask Swaps. The stated ankrETH swap total is 77.911105628282457579 across 26 transfers, but that amount is explicitly unverified in the source. Individual ANKR swap quantities are also qualified as unverified transfer-screen readings.

The distinction matters: this supports a described conversion route, not an independently established exchange cash-out. The swap router is not a custodial exchange deposit address. The report also records an mUSD round trip rather than a net movement; counting both sides as fresh proceeds would overstate value.

The aMATICc, aMATICb and fETH positions are described as unmoved after receipt. A later balance read also lists remaining ankrETH and POL. The relevant balances are qualified in the source, and the read returned no block height. They should not be presented as guaranteed recoverable assets or as live balances after the report’s retrieval time.

The consolidation address introduces an attribution boundary

At 11:36:59, the report records a native ETH transfer from the recipient to a consolidation address. The narrative quantity is 104.715783419546018142 ETH, explicitly unverified against the retained amount evidence. The same address received value from two other senders before depositing to the mixer-labeled endpoint.

Between 11:39:59 and 11:44:35, the report lists 12 deposits with denominations of 100, 10, 1 and 0.1 ETH. Its stated aggregate is 113.7 ETH, also unverified. That total is the hub’s described deposit volume, not an amount attributable solely to this incident. It includes value from other senders. The recipient-to-hub amount, the hub’s deposits and earlier token releases must not be added as separate losses.

Figure 2. Route described in the source: bridge → recipient → consolidation hub → mixer-labeled endpoint. Equal-width arrows show sequence, not proportional value. The dashed boundary marks where onward tracing is not established. Source: PDF pp. 3–7, 9–10, 14–15.

No exchange-deposit leg is observed within the report’s scope through November 11. That is a scope-limited finding, not proof that a later exchange deposit cannot occur. Movement onward from the mixer is not established, and possible exit addresses cannot be treated as deterministic matches.

Noise is not another loss or another operator

The recipient’s transfer screen contains repeated “ETH” events and look-alike counterparties. The report distinguishes those events from the native ledger, which records one native outbound debit from the recipient in the relevant sequence. It classifies additional rows, forged token symbols and small look-alike transfers as suspected address poisoning or spam rather than additional economic outflows.

This prevents two errors: multiplying the incident amount by repeated screen rows, and treating shared poisoning senders as evidence of common ownership. The report retains these records but does not use them to establish control of the incident addresses. Funding relationships alone likewise do not identify an individual or prove common control.

What the evidence leaves open

The bridge’s withdrawal authorization mechanism remains undetermined. The available evidence does not establish how the relevant function and additional event authorized the releases. Proposed explanations remain unconfirmed; no specific root cause is established in this analysis.

The identities and attribution status of the relayer and recipient remain unverified. The mixer designation is a source label, not an independently verified identity or sanctions determination. No conclusion about address ownership or sanctions status follows from that label alone.

Response priorities supported by the trace

The source identifies three practical investigative directions. First, preserve swap-order metadata for the recipient’s MetaMask Swaps activity. That could provide an off-chain lead, subject to the provider’s records and the appropriate process. Second, obtain first-party decoding from the bridge operator to establish how the releases were authorized. Third, examine the sources funding the operating addresses and consolidation hub.

The report also recommends assessing whether issuer controls could apply to unmoved token positions. It does not establish that such controls exist or guarantee recovery. These are investigative recommendations, not actions already taken by ChainBounty.

Figure 3. Conclusion: a recorded release sequence and described onward route, with mechanism, identity and mixer exits unresolved. Source: PDF pp. 14–15.

The useful outcome is a bounded case map: five bridge releases, subsequent asset conversion, a consolidation route and a mixer boundary. The next evidentiary step is to clarify authorization and funding origin without turning uncertain amounts, poisoning artifacts or address proximity into stronger claims than the record supports.

Address and transaction key

Bridge: 0xC437DF90B37C1dB6657339E31BfE54627f0e7181

Relayer: 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703

Recipient: 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6

Consolidation hub: 0x92b2a947551d780f94dda2ef7ec566accdbd796d

First bridge release: transaction. Recipient-to-hub leg: transaction. These links identify the transaction records cited in the underlying report; the evidence qualifications above continue to apply.

Source and limitations note

Source: investigation report dated November 11, 2026, 30 pages. The report covers 108 traced movements across 20 addresses and $665,062.85 in movements that could be priced. This is aggregate priced movement volume, not incident loss. The reviewed query spans October 10–November 11; the incident narrative focuses on November 9–11.

Several quantities remain unverified. Thirteen transaction hashes listed in the report’s Fund-Flow Summary are not supported by the retained transaction evidence. This limitation does not establish that those transactions do not exist, but they cannot be treated as verified anchors on that basis. The described route does not, by itself, verify each amount.

This article presents the underlying report’s findings and qualifications. It does not establish a complete loss or recovery total, the authorization failure, address ownership, sanctions status or the destination of mixer withdrawals.