Verus Ethereum Bridge hacked again for $7.54M after May exploit

The Verus Ethereum Bridge has suffered another exploit, with an attacker draining about $7.54 million in assets from the same contract hit in May. 

Blockchain security firm Blockaid detected the attack on Ethereum on July 23 and said the attacker used the bridge’s import path to trigger payouts that were not backed by matching assets on the source side.

The incident involved a different transaction and attacker-controlled wallet from the May breach, according to Blockaid. The firm said the new attack used the same bridge contract, entry path and apparent bug class. However, the exact root cause remained under investigation when the alert was published.

Verus bridge exploit drains multiple assets

Onchain records show the exploit transaction interacted with the Verus Ethereum Bridge contract at 03:45 UTC on July 23. The transaction transferred about 1,137 ETH and several tokens to an attacker-controlled address. The assets included tBTC, USDC, USDT, EURC, MKR and scrvUSD. Etherscan valued the main bridge outflows at roughly $7.54 million at the time.

Blockaid said the attacker abused the bridge import process to produce unbacked Ethereum-side payouts. The firm identified the receiving address as 0xCFd0…2D54 and linked the withdrawal to the same bridge contract involved in the earlier Verus incident. It has not yet published a complete technical report on the new transaction.

Additionally, the latest exploit comes about two months after the Verus Ethereum Bridge lost roughly $11.58 million in a separate attack. Security researchers said the May attacker exploited a validation gap that allowed a forged cross-chain import to pass verification even though the value committed on the source side did not match the payout released on Ethereum.

Blockaid said the July attack “appears related to the previous Verus Ethereum Bridge incident in May 2026.” It also described the two incidents as involving the “same bridge contract, same entry path, and same bug class,” although a confirmed technical cause for the latest exploit has not been released.

As crypto.news reported in May, the first Verus bridge attacker later returned 4,052.4 ETH, worth about $8.5 million at the time, after the project offered settlement terms. The attacker kept 1,350 ETH as a bounty. The returned amount represented about 75% of the funds held by the exploiter after the stolen assets had been converted into ETH.

Three exploits reported within hours

The Verus attack formed part of a broader series of security incidents reported within hours. Onchain tracker Lookonchain said AFX Trade, Verus and B² Network had suffered exploits with combined reported losses of about $35.55 million. The figures included $24.15 million from AFX, about $7.55 million from Verus and roughly $3.86 million from B² Network.

Earlier today, an AFX-operated bridge lost $24.15 million in USDC before the attacker moved the funds to Ethereum and converted them into 12,467 ETH. Offchain Labs said that incident did not affect Arbitrum’s native bridge and originated from infrastructure operated by a third-party protocol.

The incidents add to continued scrutiny of cross-chain systems. A recent crypto.news explainer noted that bridges must verify events across separate blockchains while controlling assets held in shared reserves. Errors in message validation, contract logic or access controls can allow a transaction to release assets without a valid matching transfer.

Root cause and recovery details remain pending

Blockaid said the new Verus exploit appears to involve the same type of weakness seen in May, but stopped short of confirming that the exact earlier vulnerability caused the July drain. The May attack involved missing validation between the value committed on the source chain and the amount released on Ethereum, according to security analyses.

The latest transaction confirms that funds left the Verus bridge for the new attacker wallet, but the reviewed sources did not confirm whether any assets had since been frozen, returned or recovered. They also did not provide a new remediation plan or a timeline for changes to bridge operations.

Further technical details could clarify whether the May flaw remained exploitable, whether a related weakness caused the new incident, or whether the attacker used another route through the same import process. The attacker’s next fund movements could also show whether the stolen assets are converted or moved through other services.

The case remains a developing story.