Verus-Ethereum Bridge loses $11.5 million in active exploit

The Verus‑Ethereum bridge has been drained of roughly $11.5 million after an attacker exploited a validation flaw in the bridge’s verification process on May 18, 2026 [2]. Security firm Blockaid flagged the breach in real time, identifying the malicious wallet 0x5aBb…D5777 and a downstream holding address 0x65Cb…C25F9 where the stolen assets were consolidated [2].

The exploit hinged on a forged cross‑chain transfer message that bypassed the bridge’s source‑amount checks. By sending a low‑cost transaction on Verus—about $10 in fees—the attacker created a payout hash without any corresponding value on the Verus side, then submitted matching data to the Ethereum contract, which released the funds [3]. Blockaid, PeckShield and ExVul all traced the flaw to a missing validation step in the Solidity code, a bug that could be patched with roughly ten lines of code [2][3].

On‑chain data show the drained assets included 1,625 ETH, 103.6 tBTC and nearly 147,000 USDC, which the attacker quickly swapped into 5,402 ETH, valued at about $11.4 million at current prices [2]. The attacker’s wallet had previously received 1 ETH from the Tornado Cash mixer, a pattern often seen in attempts to obscure transaction origins [2]. As of the latest reports, the funds remain untouched in the drainer wallet, and the Verus team has not issued a public response [1][3].

This breach adds to a string of high‑profile bridge attacks in 2026, including a $10 million exploit on THORChain and multi‑hundred‑million losses on Drift and Kelp protocols earlier in the year [2]. The incident underscores that even well‑audited cross‑chain infrastructure can harbor subtle economic gaps, prompting renewed calls for stricter payload validation, layered verification and emergency pause mechanisms [3].

The open question now is whether Verus will pause the bridge, roll out the quick code fix, and how quickly the community can restore confidence in a sector where each new exploit erodes trust in decentralized finance’s interoperability promises.