Security firm Blockaid flagged an attacker submitting five withdrawal calls on Ankr's Ethereum cross-chain bridge, each one referencing a small Optimism deposit that had already been redeemed.

That single deposit was enough to unlock the bridge's full locked inventory, which the attacker moved to a newly created address. Early estimates put losses near $292,000 while the attack was still running.

Priced tokens removed across the five withdrawals total about $303,600, and the bridge contract remained unpaused as of 3:49 a.m. ET.

Ankr runs node and staking infrastructure across dozens of chains. An unpaused contract leaves any remaining bridged assets exposed until the team halts withdrawals.