The Verus-Ethereum bridge has been exploited for over $11.5 million after an attacker manipulated cross-chain message validation, according to several blockchain security firms. The incident was first flagged by Blockaid, which detected suspicious activity on the bridge late Sunday. The attacker’s wallet, identified as 0x5aBb…D5777, initially moved stolen funds to another address, 0x65C…C25F9.
PeckShield reported that the drained assets included 103.6 tBTC, 1,625 ETH, and nearly 147,000 USDC. The attacker later swapped these for 5,402 ETH, worth approximately $11.4 million. Prior to the exploit, the attacker’s wallet received 1 ETH via Tornado Cash, a common tactic to obscure transaction origins.
GoPlus Security noted that the attacker first sent a low-value transaction to the bridge contract before triggering a function that transferred reserve assets in batches to the drainer wallet. The firm suggested the exploit was likely due to cross-chain message validation failure, withdrawal logic bypass, or an access control weakness.
Blockaid compared the attack to the 2022 Nomad Bridge and Wormhole exploits, where fake transfer instructions tricked protocols into releasing funds. The security firm clarified that the issue was not an ECDSA bypass or notary key compromise, but a missing source-amount validation in the checkCCEValues function—a flaw fixable with about 10 lines of Solidity code.
ExVul reached a similar conclusion, stating the attacker used a forged cross-chain import payload that passed verification, triggering three transfers from bridge reserves. ExVul recommended tying transfer execution to authenticated payload data, stricter validation, layered verification, and emergency pause mechanisms for unusual outbound transfers.
Launched in 2023, the Verus-Ethereum bridge enables asset transfers between the Verus network and Ethereum. The Verus protocol, introduced in 2018, uses a hybrid proof-of-work and proof-of-stake model. As of publication, the Verus team had not commented on the exploit.
This breach adds to a growing list of DeFi attacks in 2026, with hackers stealing over $168.6 million from 34 protocols in Q1 alone. Major incidents include the $280 million Drift Protocol exploit and the $292 million Kelp exploit in April. Over the weekend, THORChain also suffered a $10 million exploit, highlighting ongoing vulnerabilities in cross-chain infrastructure.