The receipts were forged. The signatures were real. That's the whole bug.
Ankr's Ethereum bridge got drained this morning by five withdrawal receipts that all pointed at one already-redeemed Optimism deposit. About $286K to $304K, depending on which security firm's calculator you trust.
Follow the Value: 82.91 ankrETH, ~7.98M $ANKR, 515K ankrPOL. Bridge balance of all five: zero. The contract checked who signed. It never checked whether the deposit happened. The ANKR and most of the ankrETH were sold for ETH within about 90 minutes. The 3-of-5 multisig hit pause at 09:51 UTC, after the vault was already empty. A very firm pause on an empty room.
How a trusted signer ended up co-signing fiction is still unconfirmed.
Ankr's X feed this afternoon: World Chain live on Ankr RPC, "battle-tested." No bridge statement that I can find.
Winner: the wallet sitting on ~104 ETH. Still open: who eats the hole.
If one key can approve any withdrawal, is that a bridge or a hot wallet with paperwork?