The Verus-Ethereum Bridge has been hit by its second major hack in as many months, with attackers draining approximately $7.54 million in various cryptocurrencies. The incident, detected on July 23, 2026, at 03:45 UTC by blockchain security firm Blockaid, exploited a vulnerability alarmingly similar to one used in a May breach.
This repeated security failure raises urgent questions about the fundamental safety of the cross-chain bridge and the effectiveness of prior attempts to secure it. It also underscores the persistent challenges decentralized protocols face in validating cross-chain transactions.
second verus-ethereum bridge hack details emerge
The latest Verus-Ethereum Bridge hack saw a total of $7.54 million vanish from the protocol. On-chain data confirms the swift movement of assets, including Ethereum (ETH), tokenized Bitcoin (tBTC), USD Coin (USDC), Tether (USDT), EURC, Maker (MKR), and Savings crvUSD (scrvUSD).
Blockaid identified the attacker’s wallet as 0xCFd0…2D54, noting the perpetrator manipulated the bridge’s import process, specifically the submitImports function. This allowed funds to be released on the Ethereum side without corresponding assets being deposited on the source chain, effectively creating unbacked payouts.
Following the exploit, the stolen assets were consolidated into 3,916 ETH through various decentralized exchange routes. Subsequently, portions of this ETH were routed through Tornado Cash, a well-known mixer, in an apparent attempt to obscure the trail and launder the funds.
Independent researcher exvulsec corroborated Blockaid’s findings, confirming the exploit signature within minutes of its occurrence. The rapid detection highlights the vigilance of the blockchain security community but also the speed and sophistication of the attackers.
echoes of the may 2026 bridge exploit
This July 23 Verus-Ethereum Bridge hack bears a striking resemblance to a prior exploit on May 17, 2026. That earlier incident saw approximately $11.58 million stolen from the same bridge, utilizing what appears to be an almost identical vulnerability.
Both attacks targeted the same bridge contract (0x71518580f36FeCEFfE0721F06bA4703218cD7F63) and entry path (`submitImports`). This suggests a core flaw either remained unaddressed or was incompletely patched after the May event, despite the significant financial impact of that initial breach.
In a notable turn of events after the May hack, the original attacker returned 4,052.4 ETH, then valued at about $8.5 million. They retained 1,350 ETH as a white-hat bounty, a common practice in the decentralized finance (DeFi) space to encourage return of funds.
The recovered funds from the May incident were subsequently redeposited into the bridge on July 8, 2026, just days before this second attack. While the July attacker used a different wallet, Blockaid confirms the vulnerability exploited was from the same bug category.
the persistent vulnerability in cross-chain validation
At the heart of both Verus-Ethereum Bridge hack incidents lies a critical structural vulnerability: missing input validation. The exploit mechanism allowed attackers to create a fundamental mismatch between input and output, where the amount claimed on Verus did not align with the payout on Ethereum.
Specifically, the `VerusProof.checkExportAndTransfers` function has been identified as a key point of failure. This function reportedly checked the transfer hash but crucially failed to verify if the assets were genuinely backed on the Verus side, creating an avenue for manipulation.
Attackers leveraged validly signed cross-chain import (CCE) transactions. They injected vastly inflated token amounts and a controlled destination address, all while retaining genuine cryptographic proof. This indicates the flaw wasn’t a cryptographic weakness, but rather a logical error in the validation process.
For instance, in the May incident, a mere $0.01 worth of VRSC was reportedly used to trigger an $11.58 million payout. This highlights the severity of the validation gap, allowing minimal input to unlock immense value without proper backing.
broader implications for bridge security
The Verus-Ethereum Bridge hack is part of a larger, troubling trend impacting cross-chain protocols. These bridges are designed to connect disparate blockchains like Verus and Ethereum, enabling the movement of assets by locking value on one chain and releasing it on another.
Ideally, such bridges should be trustless, decentralized, and non-custodial, relying on cryptographic proofs and validation by network participants. However, repeated exploits expose inherent complexities and vulnerabilities in their design and implementation, challenging their “trustless” claims.
This particular incident comes amidst a flurry of related cyberattacks. The July 23, 2026, date saw total losses across multiple protocols estimated at $35.55 million, including significant hacks against AFX Trade, which lost $24.15 million in USDC, and B² Network, which saw $3.86 million vanish.
The lack of a public statement from VerusCoin regarding the July 23 exploit adds to the uncertainty surrounding the bridge’s future. Users have been strongly advised to avoid using the bridge for the foreseeable future, a critical measure as investigations continue into the full extent of the vulnerability and potential remediation strategies.