Incident Overview
On July 23, 2026, the cross-chain bridge connecting the Verus blockchain to Ethereum was exploited for the second time in two months, resulting in the unauthorized extraction of approximately $7.53 million across multiple digital assets.
The exploit targeted a semantic and authority validation flaw in how the Ethereum-side bridge contract verifies cross-chain export outputs from Verus. While the contract verified that a given export payload existed within a valid Verus block and matched a genuine state root notarized on Ethereum, it failed to verify that the Verus network itself had authorized the payload as a legitimate primary export. The attacker initiated a tiny 0.01 VRSC bridge transaction to create a valid export state, then authored a custom Verus transaction spending that output and attaching a handwritten export commitment declaring 8 transfer instructions to the attacker's wallet.
After relaying two legitimate notarizations to Ethereum containing the state root of their custom transaction, the attacker submitted the import request. Because the cryptographic Merkle proofs and payload hash checks matched the attacker-controlled input data, the bridge executed the transfer, releasing $7.53 million in tBTC, DAI, USDC, scrvUSD, USDT, MKR, and EURC. The stolen assets were immediately swapped on-chain for 3,916.1 ETH and deposited into Tornado Cash.
Attacker Address: 0xCFd0A207…142D54
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Verus, these are the critical security checks that could have prevented this incident (July 2026).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Audit Report 1 Report
Sources & References
- 01
- 02
Learn to Prevent the Next Verus
The Verus hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.