The perpetrator behind the exploit of the Verus Ethereum bridge has returned 4,052.4 ETH, approximately $8.5 million, to the project team following a negotiated settlement. This move leaves the attacker with 1,350 ETH, valued at around $2.86 million, as a bounty for returning the majority of the stolen funds.
Blockchain security firm PeckShield confirmed the transaction, noting that the returned assets constitute 75% of the total funds drained during the incident. The remaining 25% was intentionally left with the exploiter as a reward, per the terms proposed by the Verus community. On-chain data from Etherscan reveals that the return occurred on May 21, with the funds moving from a wallet labeled as Verus Exploiter 2 to a designated team address. Shortly after, the bounty amount was transferred to a separate wallet.
This outcome has sparked mixed reactions in the crypto community. Some observers, like Bee Swarm, view the 75% recovery as a positive precedent, suggesting that bounty-driven negotiations can be more effective than legal threats for retrieving stolen assets. Others, such as Zenthis, caution that partial recoveries do not address fundamental vulnerabilities in bridge security, arguing for more robust alternatives like atomic swaps to eliminate centralized custody risks.
The return follows a public offer from Verus, which outlined specific terms for the exploiter to follow. The community had agreed to a 1,350 ETH bounty in exchange for the safe return of the remaining funds. This approach contrasts with many past bridge attacks, where stolen assets are often laundered through mixers or remain under the attacker’s control indefinitely.
The Verus bridge exploit, which occurred on May 18, resulted in losses exceeding $11.5 million. Security researchers attributed the breach to a forged cross-chain transfer message that bypassed validation checks. The attacker initially drained 103.6 tBTC, 1,625 ETH, and nearly 147,000 USDC, later converting these assets into 5,402 ETH. Blockaid identified the root cause as missing source-amount validation within the bridge’s logic, ruling out other common attack vectors like ECDSA bypass or key compromise.
The incident adds to a growing list of cross-chain security failures. Recent attacks on the Butter Network bridge led to a 96% crash in MAPO tokens after attackers minted unauthorized tokens. Similarly, Echo Protocol faced a $76.7 million exploit involving fake eBTC collateral. These events highlight the persistent risks in bridge security, where weak validation can enable attackers to trigger unauthorized transfers or mint tokens before teams can intervene.