Verus-Ethereum Bridge Loses $11.58 Million in Possible Validation Exploit

Highlights:

• Blockaid flagged an active attack on the Verus-Ethereum Bridge, draining roughly $11.58 million.
• The attacker took tBTC, ETH, and USDC, then swapped everything into 5,402 ETH to obscure the trail.
• A bridge validation flaw may have let a small Verus transaction unlock far larger Ethereum payouts.

The Verus-Ethereum Bridge suffered an exploit on Monday, and attackers drained about $11.58 million in crypto assets. Blockchain security firm Blockaid first flagged the attack and said its exploit detection system found an ongoing exploit on the bridge. The bridge connects the Verus network with Ethereum and allows users to move assets between the two blockchains.

Advertisement

Security firm PeckShield later reported that the attacker took around 103.6 tBTC, 1,625 ETH, and 147,000 USDC from the bridge. The attacker then swapped the stolen assets into about 5,402.4 ETH. The funds remained in an Ethereum wallet linked to the exploit, according to on-chain security reports.

#PeckShieldAlert The @veruscoin Verus-Ethereum Bridge has been drained for 103.6 $tBTC, 1.625K $ETH, and 147K $USDC.

The exploiter swapped the stolen assets for 5,402.4 $ETH (~$11.4M), which currently sits in 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9.

The attacker’s address… https://t.co/DK0CDUAcqb pic.twitter.com/NMa8abhaTH

— PeckShieldAlert (@PeckShieldAlert) May 18, 2026

The attacker converted the stolen funds into ETH after the exploit. This move is common in crypto attacks because ETH has deep liquidity and can move across many wallets and services. PeckShield also reported that the attacker’s address received 1 ETH through Tornado Cash around 14 hours before the attack. Tornado Cash is a crypto mixing tool that can make fund movements harder to trace.

Blockaid flagged the attack as still ongoing when it issued its alert, meaning the final loss figure could change as investigators identify more linked transactions.

🚨 Community alert:
Blockaid's exploit detection system has identified an on-going exploit on the @veruscoin Verus-Ethereum Bridge (https://t.co/HEwYZqFEfC).
~$11.58M drained so far.

More details in🧵

— Blockaid (@blockaid_) May 18, 2026

Blockaid Points to Possible Bridge Validation Flaw

Blockaid’s later analysis added an important technical angle to the case. According to the firm, the exploit may not have involved stolen notary keys, broken cryptography, or an ECDSA signature bypass. Instead, Blockaid pointed to a possible weakness in the bridge’s validation process.

In simple terms, the bridge may have approved a transfer without fully checking whether the Ethereum payout was properly backed on the Verus side. Early reports suggest there may have been a mismatch between the source-chain transaction and the payout on Ethereum. That means the attacker may have used a small Verus-side transaction to trigger a much larger release of funds on Ethereum.

🔎 Verus-Ethereum Bridge $11.58M drain – Suspected root cause

Same class as Wormhole-2022 / Nomad-2022: source ↔ destination economic-value binding gap.

What the bridge correctly verifies:
✓ Notarized Verus state root (8/15 valid notary sigs, all cryptographically sound)
✓…

— Blockaid (@blockaid_) May 18, 2026

Verus has not yet released a full public post-mortem on the exploit. So the technical explanation above is based on Blockaid’s early analysis and on-chain security reports, not an official confirmation from the Verus team.

Verus Bridge Design Faces Fresh Scrutiny

The official Verus website describes the bridge as non-custodial and proof-based. It uses the Verus Internet Protocol for cross-chain communication and relies on miners and stakers for verification. According to Verus, nothing moves on the Ethereum side until it is proven and verified by consensus on the Verus side, and all assets in the Ethereum smart contract are secured by the Verus network.

A non-custodial bridge means no single company controls user funds. Instead, the system relies on code, cryptographic proofs, and validators to confirm transfers. That said, bridges remain one of the riskiest parts of crypto infrastructure. They connect separate blockchains and typically hold large pools of assets, making them a constant target for attackers.

Once again, it becomes clear from the Verus hack that bridge security goes beyond proving something mathematically through cryptography. The ability to properly validate value, liquidity, and transactional logic on both sides is equally important for bridges. Failure to do so may result in attacks draining funds even without breaking the cryptographic system itself.

Advertisement