What happened
At 23:55 UTC on May 17, 2026, an attacker drained about $11.58 million from the Verus-Ethereum bridge in one submitImports() transaction: 1,625.37 ETH, 103.57 tBTC and 147,658 USDC. No keys or notary signatures were compromised. The attacker got the Verus notaries to sign a cross-chain export that committed almost no value on Verus (about $0.01 of VRSC) but carried an $11.58 million payout for Ethereum. The Ethereum contract checked the notary signatures and the export's hash, but checkCCEValues never checked that the value deposited on Verus matched the value paid out, so the bridge released the funds from its reserves. The attacker swapped the proceeds into about 5,402 ETH in the receiving wallet.
On May 22, after Verus offered to treat 1,350 ETH as a bounty and not pursue further action, the attacker returned 4,052.4 ETH (about $8.5 million, roughly 75% of the haul) and kept 1,350 ETH (about $2.8 million).
**On-chain references**
- Bridge contract:
0x71518580f36feceffe0721f06ba4703218cd7f63 - Exploit transaction:
0x6990f01720f57fc515d0e976a0c4f8157e0a9529194c4c15d190e98d087eb321 - Attacker EOA (Verus Exploiter 1):
0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777 - Receiving wallet (Verus Exploiter 2):
0x65Cb8b128Bf6e690761044CCECA422bb239C25F9
How it happened
- On Verus, the attacker created a cross-chain export whose source-side value was near zero (about $0.01 of VRSC) but whose transfer data paid out $11.58 million in ETH, tBTC and USDC on Ethereum.
- The export was structurally valid, so Verus notaries validated its format and Merkle proof and signed the resulting state.
- The attacker called
submitImports()on the Ethereum bridge with the matching transfer data. The contract verified the notary signatures and the data hash, then decoded the payout instructions. checkCCEValuesdid not compare the source-chain deposit with the payout, so the bridge sent 1,625.37 ETH, 103.57 tBTC and 147,658 USDC to the attacker's receiving wallet in that one transaction.- The attacker swapped the tokens into about 5,402 ETH, and on May 22 returned 4,052.4 ETH under Verus's bounty offer, keeping 1,350 ETH.
Protocol details
Evidence
- report @PeckShieldAlert incident report x.com
- report @blockaid_ incident report x.com
- transaction Etherscan transaction 0x6990f017...eb321 (Verus: Ethereum Bridge, submitImports) etherscan.io
- analysis DeFiLlama defillama.com
- analysis Explained: The Verus-Ethereum Bridge Hack (May 2026) halborn.com
- analysis Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst theblock.co
- analysis Hack Track: The $11.58M Verus Bridge Hack merklescience.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
