Verus Ethereum bridge exploited for $11.6 million in DeFi hack

The Verus Protocol’s Ethereum bridge was breached on Monday, allowing a hacker to siphon at least $11.58 million in crypto through a forged cross‑chain transfer message [1]. Blockaid’s on‑chain detection flagged the exploit and posted a transaction showing 1,625 ETH, 147,659 USDC and 103.57 tBTC v2 moved out of the bridge, a haul worth over $11.5 million [1].

Subsequent analysis by PeckShield confirmed the funds were quickly swapped into Ether, leaving a single wallet with a balance of roughly 5,402 ETH—valued at more than $11.4 million at current prices [1]. The attacker achieved this by deceiving the bridge’s verification logic, causing it to accept a “fake” import payload and bypass the source‑amount check in the contract’s checkCCEValues routine, a flaw the researchers say could be fixed with about ten lines of Solidity [1]. ExVul reached a similar conclusion, noting the payload passed the bridge’s verification flow and triggered three attacker‑attached transfers to the drainer wallet [1].

The incident mirrors earlier high‑profile bridge attacks such as the $190 million Nomad exploit and the $325 million Wormhole breach, underscoring a recurring vulnerability in cross‑chain infrastructure [1]. While Verus has not publicly confirmed the hack, the protocol’s team indicated a post‑mortem and security overhaul are forthcoming before any bridge re‑enabling [2].

For the broader market, the consolidated 5,402 ETH represents a modest sell pressure relative to daily Ethereum volume, but its timing could stress leveraged long positions that opened near the recent $2,187 high. Traders with 30‑50× ETH longs are already near liquidation thresholds, and any sudden off‑loading from the attacker’s wallet could trigger cascading liquidations if ETH slips below its 24‑hour low of $2,086 [2].

The exploit adds to a string of Q1 2026 DeFi breaches that have already cost hackers over $168 million across 34 protocols, reinforcing a “structural reset” narrative for cross‑chain services [1]. As the attacker’s wallet activity unfolds, the key question for market participants is whether the Ether will be moved to centralized exchanges, prompting a price dip, or held dormant, limiting broader contagion.