Incident Overview
On May 18, 2026, the Verus-Ethereum Bridge was exploited for approximately $11.58M across ETH, tBTC, and USDC due to a logic gap in its cross-chain value validation. The attacker successfully bypassed economic checks without compromising any cryptographic keys or notary signatures, instead exploiting a failure to match source-chain deposits with destination-chain payouts. The stolen assets were subsequently swapped and consolidated into a single Ethereum drainer wallet.
The exploit represents an economic-value binding gap, the same vulnerability class that impacted the Wormhole and Nomad bridges in 2022. While the Ethereum side of the bridge properly validated the cryptographic proofs, notarized state roots, and Merkle proofs sent from the Verus chain, it failed to verify the underlying math. Specifically, a missing validation check in the bridge’s checkCCEValues function allowed cross-chain exports to process even if the source-chain's token totals were entirely empty.
To execute the attack, the exploiter initiated a tiny 0.02 VRSC transaction on the Verus network containing a Cross-Chain Export that committed to a high-value payout blob, but intentionally left the source-side deposit fields blank. Since the transaction structure was technically legal on the Verus network, the notaries signed the state root. The attacker then called submitImports() on Ethereum with the matching transfer data. The bridge verified the legitimate cryptographic signature, decoded the payload, and released 1,625 ETH, 103 tBTC, and 147K USDC directly from its reserves to the attacker for a gas cost of roughly ten dollars.
Bridge Contract: 0x71518580…cd7f63
Exploit Transaction: 0x6990f017…7eb321
Attacker EOA: 0x5aBb91B9…9D5777
Drainer Wallet: 0x65Cb8b12…9C25F9
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Verus, these are the critical security checks that could have prevented this incident (May 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Sources & References
Learn to Prevent the Next Verus
The Verus hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.