Verus Hack

On May 18, 2026, the Verus-Ethereum Bridge was exploited for approximately $11.58M across ETH, tBTC, and USDC due to a logic gap in its cross-chain value validation. The attacker successfully bypassed economic checks without compromising any cryptographic keys or notary signatures, instead exploiting a failure to match source-chain deposits with destination-chain payouts. The stolen assets were subsequently swapped and consolidated into a single Ethereum drainer wallet.

The exploit represents an economic-value binding gap, the same vulnerability class that impacted the Wormhole and Nomad bridges in 2022. While the Ethereum side of the bridge properly validated the cryptographic proofs, notarized state roots, and Merkle proofs sent from the Verus chain, it failed to verify the underlying math. Specifically, a missing validation check in the bridge’s checkCCEValues function allowed cross-chain exports to process even if the source-chain's token totals were entirely empty.

To execute the attack, the exploiter initiated a tiny 0.02 VRSC transaction on the Verus network containing a Cross-Chain Export that committed to a high-value payout blob, but intentionally left the source-side deposit fields blank. Since the transaction structure was technically legal on the Verus network, the notaries signed the state root. The attacker then called submitImports() on Ethereum with the matching transfer data. The bridge verified the legitimate cryptographic signature, decoded the payload, and released 1,625 ETH, 103 tBTC, and 147K USDC directly from its reserves to the attacker for a gas cost of roughly ten dollars.

Bridge Contract: 0x71518580…cd7f63

Exploit Transaction: 0x6990f017…7eb321

Attacker EOA: 0x5aBb91B9…9D5777

Drainer Wallet: 0x65Cb8b12…9C25F9