In today’s crypto roundup, Ankr’s Ethereum bridge lost an estimated $304,500 through forged cross-chain withdrawal receipts, while attackers compromised Ethersphere’s software-release pipeline to distribute wallet-stealing malware. Separately, Injective halted block production during what infrastructure providers described as a coordinated upgrade test, prompting several exchanges to suspend INJ transfers. Meanwhile, a Hyperliquid wallet linked by analysts to the UXLINK exploiter began unwinding a large Ethereum position amid reports of $148 million in broader leveraged exposure.
Ankr bridge loses $304,500 through forged withdrawal receipts
Ankr’s Ethereum cross-chain bridge suffered an exploit on November 9 that allowed an attacker to withdraw approximately $304,500 in cryptocurrency using five forged cross-chain receipts, according to blockchain security firm SlowMist.
The attacker reused a single legitimate transaction on Optimism, modifying the recipient, token and withdrawal amounts to create five apparently authorized withdrawal requests on Ethereum.
SlowMist found that all five receipts carried valid signatures from the bridge’s trusted consensus signer. The bridge’s withdrawal function accepted those signatures and released assets without independently verifying that the corresponding withdrawals had occurred on the originating blockchain.
Five receipts, one underlying Optimism transaction, and the bridge paid them all.
The stolen assets included approximately 82.91 ankrETH, 7.98 million ANKR, 515,206 ankrPOL, 5,372 aPOLb and 0.82 aETHb. The attacker sent the withdrawals to an Ethereum address beginning 0x119d250b, using transactions initiated by another address beginning 0x9a88dd45.
Blockaid initially estimated the losses at approximately $292,000, while SlowMist’s subsequent analysis placed the figure at $304,500. The difference reflects estimates published at different stages of the investigation rather than a confirmed additional attack.
The technical findings identify a failure in withdrawal authorization, but they do not establish how the attacker obtained the valid signatures. A compromised signer, leaked credentials or another unauthorized signing mechanism remains possible, though none has been confirmed.
SlowMist seperately identified the forged receipts as the immediate mechanism enabling the withdrawals. Earlier movements involving Ankr-related operator wallets have also attracted scrutiny, but no verified evidence connects those transactions to the source of the unauthorized signatures.
The incident follows the zkLink Nova bridge exploit that drained approximately $783,100 on October 29. That attack involved manipulating withdrawal-verification roots, a different mechanism that nevertheless resulted in unauthorized asset releases from Ethereum escrow contracts.
In Ankr’s case, the unresolved issue is whether the trusted signing process itself was compromised or whether another weakness allowed valid signatures to accompany fabricated withdrawal data. The available investigation does not establish a confirmed recovery amount or identify the individual responsible.
Ethersphere malware reaches npm and signed desktop releases
Security researchers identified a coordinated software supply-chain attack against Ethersphere on November 9, after malicious versions of its bee-js JavaScript package and Swarm Desktop application were distributed through legitimate release channels.
StepSecurity detected malicious code in @ethersphere/bee-js version 13.3.0, published to npm at 00:09:50 UTC. The compromised package contained an installation script that downloaded and executed additional JavaScript from attacker-controlled infrastructure at api.frameworkmetrics[.]xyz.
The payload targeted Swarm node wallet files, configuration passwords and operating-system access. Researchers found mechanisms capable of installing persistent remote access on Linux, macOS and Windows.
The attack also reached Swarm Desktop version 0.56.2, published approximately 30 minutes after the npm release. Socket’s investigation found that the compromised desktop application executed a similar malicious loader when launched.
Its macOS installer was signed and notarized, while the npm package carried valid trusted-publishing provenance generated by Ethersphere’s legitimate GitHub Actions workflow.
The release looked normal enough, and that was part of the problem.
Researchers traced the npm publication to an unsigned commit made under the project’s bee-worker release identity on November 8. The legitimate publishing workflow subsequently built and distributed the compromised source code.
Socket also linked the malware’s command-and-control infrastructure to the earlier SleepyDuck and EtherDuck campaign, identifying shared Ethereum-based configuration infrastructure and previously documented payload components.
The malicious npm version remained available for approximately 75 minutes. Swarm Desktop 0.56.2 was publicly accessible for roughly eight and a half hours, with some Windows and Apple Silicon macOS installations potentially exposed through automatic updates.
Ethersphere subsequently withdrew the affected releases, and researchers identified Swarm Desktop 0.56.3 as the clean replacement. The malicious npm package was removed from the registry, with version 13.2.0 remaining the last verified clean release in the investigations reviewed.
The Open Source Vulnerabilities database record MAL-2026-18773, published November 9, identifies bee-js 13.3.0 as malicious and warns that systems which installed or executed the package should be treated as potentially compromised.
Pulling the update later does not roll back what the code already did, that’s the awkward part.
Researchers recommended checking installed versions, removing malicious releases, rebuilding affected systems where appropriate and rotating accessible credentials from clean devices. Swarm Desktop users were also advised to replace potentially exposed wallet keys and passwords.
Socket reported 65 downloads of Swarm Desktop 0.56.2 by 08:27 UTC, although that total included security researchers and did not represent 65 confirmed infections. There is no established count of compromised computers or verified cryptocurrency theft attributable to the incident.
The malware’s ability to target wallet credentials resembles the threat examined in DaveFinances’ earlier investigation into a fake Zano wallet distributing remote-access malware. The Ethersphere incident differs because the malicious software entered through the genuine project’s release infrastructure rather than an impersonation website.
The attack demonstrates a specific weakness in the software distribution process: valid publishing provenance and code signatures can accompany malicious software when attackers gain access before trusted release workflows execute.
Injective block halt prompts exchanges to suspend INJ transfers
Injective’s mainnet stopped producing blocks on November 9, prompting South Korean cryptocurrency exchanges Upbit, Coinone and Bithumb to suspend INJ deposits and withdrawals.
Independent blockchain monitoring identified the interruption near block height 191,016,662, timestamped approximately 13:05 UTC. Public network endpoints subsequently continued returning the same block height, indicating that normal block production had stopped.
Upbit announced that INJ deposits and withdrawals were temporarily unavailable because of the network interruption, while confirming that spot trading remained operational. Coinone and Bithumb issued similar restrictions.
The chain stopped, the coin kept trading.
QuickNode published an incident notice at 13:52 UTC describing the interruption as a scheduled Injective mainnet upgrade test conducted in coordination with validators.
The infrastructure provider said the exercise was connected to preparations for an upcoming network upgrade and could temporarily interrupt block production or cause blockchain endpoints to return stale data and errors. It identified the issue as chain-wide rather than a failure of QuickNode’s own infrastructure.
An administrator in Injective’s official Telegram community also reportedly attributed the interruption to a planned network-readiness exercise intended to test coordinated validator procedures.
The explanation differs from an unexpected consensus failure caused by a software exploit. No evidence reviewed establishes stolen assets, a malicious network attack or unauthorized changes to blockchain state.
Later checks of the Injective blockchain explorer showed blocks beyond the previously stalled height, including block 191,031,440 timestamped 21:36:50 UTC on November 9. This indicates that block production had resumed by that point, although the precise restart time was not established.
Exchange withdrawal availabilty remained a seperate operational question. The emergence of new blocks did not itself confirm that Upbit, Coinone or Bithumb had reopened their INJ transfer services.
During the interruption, trading could continue inside participating exchanges because internal order matching does not require every trade to settle immediately on Injective’s blockchain. Blockchain deposits and withdrawals, by contrast, depend on functioning network infrastructure and the exchange’s subsequent confirmation of stability.
The evidence supports a temporary chain-wide interruption associated with an upgrade test, followed by renewed block production. It does not support describing the incident as a confirmed blockchain exploit.
UXLINK-linked wallet begins unwinding Hyperliquid ETH long
A Hyperliquid wallet associated by blockchain analyst EmberCN with the UXLINK exploiter began reducing a large leveraged Ethereum position on November 9, amid reports that the same trading operation held approximately $148 million in combined ETH, SOL and XRP exposure.
EmberCN reported that the positions were established in August and comprised approximately 30,282 ETH, 550,000 SOL and 35.03 million XRP. The analyst estimated that closing the combined positions could produce losses of approximately $3.3 million.
The reported account began executing a 16-hour time-weighted average price, or TWAP, strategy intended to sell its exposure through smaller transactions rather than a single market order.
An independant examination of Hyperliquid’s public trading data corroborated the Ethereum component. Wallet 0xde8d9e530b0528ffa7b1190f862536c055dd9524 had submitted a TWAP order to sell 30,282.4035 ETH over 960 minutes.
At an 08:45 UTC snapshot, approximately 5,974.5 ETH had been sold at an average price of $2,108.29, leaving around 24,307.9 ETH open. The completed sales had generated roughly $156,320 in realized trading losses before $5,668 in fees.
The wallet’s ETH entry price was approximately $2,134.45, and the remaining position had an unrealized loss of roughly $533,602 at that observation. Historical trading data also showed about $1.47 million in funding payments associated with holding the position.
The ETH part is on the record; the two other positions, less so.
The same account did not display the reported SOL or XRP positions during the independent examination. Those positions could have been held through other wallets, but their ownership and execution were not confirmed from the identified address.
The alleged connection to the UXLINK exploiter also remains circumstantial. Analysts have pointed to earlier funding relationships involving addresses associated with stolen UXLINK assets, but those transfers do not independently establish that the attacker controlled the Hyperliquid trading account.
DaveFinances previously examined another large derivatives account in its November 9 report on $40 million in Hyperliquid positions attributed to the Drift Protocol exploiter. That case similarly distinguished observable leveraged trades from an unverified claim about who controlled the wallet.
The reported $148 million represents estimated combined position exposure, not a confirmed amount of cryptocurrency already sold or a realized trading loss. The projected $3.3 million loss likewise depended on the execution of the remaining orders and subsequent market prices.
Across November 9’s developments, Ankr and Ethersphere presented confirmed security incidents with different attack mechanisms, while Injective experienced an interruption linked by infrastructure providers to validator upgrade testing. The Hyperliquid activity was observable trading behavior, but the claimed hacker attribution and total portfolio exposure remained only partly verified.
Johan Shamshad is Editor-in-Chief at Dave Finances, covering financial markets, digital assets, trading platforms, brokers, fintech, payments and regulation. Since 2023, he has also worked as an editor at Gulf News, the UAE English-language newspaper published by Al Nisr Publishing LLC. His work focuses on market-moving developments, company disclosures, regulatory changes and trading infrastructure, with an emphasis on primary-source verification and practical context for traders and investors.