Verus-Ethereum Bridge loses more than $11 million in validation exploit

Traders Union
All News
Crypto News
Verus-Ethereum Bridge loses $11 million

Highlights

Verus-Ethereum Bridge lost about $11.58 million in digital assets.
The stolen assets included 1,625 ETH, 103.6 tBTC and about 147,000 USDC.
The funds were later swapped for roughly 5,402 ETH.

How the attack happened

Blockaid said its system detected an active exploit on the Verus-Ethereum Bridge. According to the firm, around $11.58 million was drained from the bridge.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

Other blockchain analysts, including PeckShield, detailed the stolen assets: 103.6 tBTC, 1,625 ETH and about 147,000 USDC. The funds were later converted into roughly 5,402 ETH, worth about $11.4 million.

The attacker’s wallet was funded with 1 ETH through Tornado Cash about 14 hours before the exploit. Such routing is often used to make it harder to trace the origin of funds.

The flaw was in bridge logic

A key detail is that the attack was not caused by compromised private keys or broken cryptography. Citing Blockaid, the vulnerability was in the validation process: the bridge correctly checked notarized state roots and Merkle proofs, but failed to confirm whether the amount on the source chain actually backed the payout on Ethereum.

Blockaid described the issue as a mismatch between the source-chain and destination-chain economic value. Under this version, the attacker created a transaction for 0.02 VRSC with modified export data that pointed to a valid payout hash but did not include the corresponding reserve balances. The import claim on Ethereum then passed validation, and the bridge automatically released the assets.

Researchers also said the issue could be fixed with an additional checkCCEValues validation in Solidity. In their view, the patch may be small in code size but critical in effect: a bridge must verify not only the structure of a proof, but also the real economic backing behind the transfer.

Another blow to bridge confidence

For the market, this incident matters not only because of the $11.58 million loss. Cross-chain bridges often hold large reserves and connect multiple networks, meaning a flaw in one point can quickly lead to losses across several types of assets.

The Verus attack came amid a broader wave of DeFi incidents. Hackers targeted 12 DeFi protocols in May 2026 alone, with total losses for the month exceeding $20 million. April was even worse, with more than $606 million in losses, including a major exploit involving the KelpDAO bridge.

We also reported Iran launches Bitcoin-based maritime insurance for the Strait of Hormuz.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.