Breaches and incidentsBriefChecked against a primary source
Verus-Ethereum bridge: missing source-amount check, drained twice, 17 to 18 May and 23 Jul 2026
Night of 17 to 18 May 2026: about USD 11.58M (1,625 ETH, about 103 tBTC, 147K USDC) for about USD 10 in fees.
- Disclosed
What happened
- Night of 17 to 18 May 2026: about USD 11.58M (1,625 ETH, about 103 tBTC, 147K USDC) for about USD 10 in fees. A second attack on 23 Jul 2026 took about USD 7.54M using the same vulnerability class (Blockaid via The Block).
- Root cause per Merkle Science: checkCCEValues did not verify that the source-chain amount matched the Ethereum payout. Signatures, Merkle proofs and hashes were all checked. The fix is about 10 lines.
- Attribution: none. The attacker wallet was pre-funded from Tornado Cash.
- Response: Verus halted its network. One report says USD 8.5M in ETH was returned after a bounty offer; not verified. No official post-mortem at the time of Merkle Science’s report.
Sources
- https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack
- https://www.theblock.co/post/401571/verus-ethereum-bridge-exploit
- https://www.theblock.co/amp/post/409489/new-verus-ethereum-bridge-attack
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.