Verus-Ethereum Bridge Exploited for $11.5 Million in Forged Proof Attack

May 18, 2026

The Verus-Ethereum bridge was exploited for approximately $11.58 million on May 18 through a forged Merkle proof attack. Attackers crafted a low-cost transaction on Verus that committed to a payout hash while leaving source totals empty, draining 1,625 ETH, 103.6 tBTC, and 147,000 USDC from bridge reserves. The exploit brings 2026's total bridge hack losses to $329 million. The flaw stemmed from incomplete value-matching logic in the Solidity code.

Verus-Ethereum bridge exploit

▪The Verus-Ethereum bridge was exploited for approximately $11.58 million in cryptocurrency assets.
▪Verus introduced the Ethereum bridge in late 2023 to facilitate seamless asset transfers between networks.
▪Blockchain security provider Blockaid was the first to publicly flag the active breach on the Verus-Ethereum bridge through its real-time detection tools.
▪The Verus development team has not issued an official statement detailing next steps as of May 18, 2026.

Attack technical mechanics

▪The Verus-Ethereum bridge contract released 1,625 ETH, 103.6 tBTC, and 147,000 USDC from its reserves without detecting the mismatch between source and destination amounts.
▪The Verus-Ethereum bridge properly checked notarized state roots from Verus, Merkle proofs for cross-chain movements, and a cryptographic hash binding for the transfer data, but overlooked confirming that the original amounts exported on the Verus side matched the payouts requested on Ethereum.
▪The Verus-Ethereum bridge exploit involved attackers crafting a low-cost transaction on Verus costing approximately $10 in fees that committed to a payout hash while leaving the source totals effectively empty.
▪The Verus-Ethereum bridge flaw stemmed from an incomplete check in the bridge's Solidity code estimated to require only about ten additional lines to fully secure the value-matching logic.

Stolen funds tracking

▪The Verus-Ethereum bridge attacker's external account is identified as 0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777.
▪The stolen assets from the Verus-Ethereum bridge are consolidated in the holding address 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9.
▪The stolen tokens from the Verus-Ethereum bridge were swiftly converted into approximately 5,402 ETH.
▪The official Verus-Ethereum bridge smart contract is located at 0x71518580f36feceffe0721f06ba4703218cd7f63.

Historical bridge vulnerabilities

▪The Wormhole bridge experienced high-profile vulnerabilities in 2022 where discrepancies between source and destination economic proofs allowed unauthorized drains.

DeFi security implications

▪The Verus-Ethereum bridge exploit adds to a growing list of cross-chain incidents in 2026.
▪Users with exposure to the Verus-Ethereum bridge are advised to monitor their positions and avoid further interactions until the situation is resolved.
▪Security firms continue to track the Verus-Ethereum bridge holding wallet for any movement of funds.