Verus-Ethereum Bridge Exploited for $11.5 Million in Forged Proof Attack

The Verus-Ethereum bridge was exploited for approximately $11.58 million on May 18 through a forged Merkle proof attack. Attackers crafted a low-cost transaction on Verus that committed to a payout hash while leaving source totals empty, draining 1,625 ETH, 103.6 tBTC, and 147,000 USDC from bridge reserves. The exploit brings 2026's total bridge hack losses to $329 million. The flaw stemmed from incomplete value-matching logic in the Solidity code.

Verus-Ethereum bridge exploit

• ▪The Verus-Ethereum bridge was exploited for approximately $11.58 million in cryptocurrency assets
• ▪Verus introduced the Ethereum bridge in late 2023 to facilitate seamless asset transfers between networks
• ▪Blockchain security provider Blockaid was the first to publicly flag the active breach on the Verus-Ethereum bridge through its real-time detection tools
• ▪The Verus development team has not issued an official statement detailing next steps as of May 18, 2026

Attack technical mechanics

• ▪The Verus-Ethereum bridge contract released 1,625 ETH, 103.6 tBTC, and 147,000 USDC from its reserves without detecting the mismatch between source and destination amounts
• ▪The Verus-Ethereum bridge properly checked notarized state roots from Verus, Merkle proofs for cross-chain movements, and a cryptographic hash binding for the transfer data, but overlooked confirming that the original amounts exported on the Verus side matched the payouts requested on Ethereum
• ▪The Verus-Ethereum bridge exploit involved attackers crafting a low-cost transaction on Verus costing approximately $10 in fees that committed to a payout hash while leaving the source totals effectively empty
• ▪The Verus-Ethereum bridge flaw stemmed from an incomplete check in the bridge's Solidity code estimated to require only about ten additional lines to fully secure the value-matching logic

Stolen funds tracking

• ▪The Verus-Ethereum bridge attacker's external account is identified as 0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777
• ▪The stolen assets from the Verus-Ethereum bridge are consolidated in the holding address 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9
• ▪The stolen tokens from the Verus-Ethereum bridge were swiftly converted into approximately 5,402 ETH
• ▪The official Verus-Ethereum bridge smart contract is located at 0x71518580f36feceffe0721f06ba4703218cd7f63

Historical bridge vulnerabilities

• ▪The Wormhole bridge experienced high-profile vulnerabilities in 2022 where discrepancies between source and destination economic proofs allowed unauthorized drains

DeFi security implications

• ▪The Verus-Ethereum bridge exploit adds to a growing list of cross-chain incidents in 2026
• ▪Users with exposure to the Verus-Ethereum bridge are advised to monitor their positions and avoid further interactions until the situation is resolved
• ▪Security firms continue to track the Verus-Ethereum bridge holding wallet for any movement of funds