A post by @SlowMist_Team on X.

Each receipt carried valid signatures from the bridge's trusted consensus signer, letting withdraw() release assets without independently verifying them against actual source-chain events. The origin of the unauthorized signatures is still under investigation, and signer compromise has not been confirmed. The attacker address 0x9A88Dd45AE846A979705c9cFdfD0f229e592D703 sent funds to recipient 0x119D250b82C1cf5345dF5912EFb4B1a4107a1Aa6, with the vulnerable contract at 0xc437DF90B37C1dB6657339E31BfE54627f0e7181. The incident highlights the risk of bridge designs that trust signer attestations over independent source-chain verification. What to watch next is whether Ankr identifies the signer as compromised and whether it adds receipt validation or reimbursement plans.