What happened in the Verus Protocol bridge exploit?

Verus Protocol’s Ethereum bridge was reportedly exploited after an attacker used a fake cross-chain transfer message to withdraw at least $11.58 million in crypto assets. Security firms said the exploit targeted weaknesses in the bridge’s validation process.

How much cryptocurrency was stolen from the Verus bridge?

Blockchain security researchers estimated the attacker drained more than $11.5 million in assets, including Ether, USDC and tBTC v2. The stolen funds were later converted into approximately 5,402 ETH.

How did the Verus Ethereum bridge exploit reportedly work?

Researchers said the attacker used a forged cross-chain import payload that tricked the bridge into processing fake transfer instructions. This allegedly allowed the bridge to release assets from its reserves to the attacker’s wallet.

What security flaw did researchers identify in the Verus exploit?

Blockaid said the exploit was caused by missing source-amount validation checks rather than stolen keys or cryptographic failures. Researchers described the issue as a bridge verification weakness.

Why are cross-chain bridges frequently targeted by hackers?

Cross-chain bridges hold large liquidity reserves and connect multiple blockchain ecosystems, making them attractive targets for attackers. Complex verification systems can also create vulnerabilities if validation logic is flawed.

Which previous crypto bridge hacks does the Verus exploit resemble?

Security firms compared the incident to the 2022 Nomad Bridge exploit, which lost around $190 million, and the Wormhole exploit, which lost approximately $325 million. Both attacks involved weaknesses in bridge validation systems.

What happened to the stolen funds after the Verus exploit?

PeckShield said onchain data showed the stolen assets were converted into Ether after the attack. The attacker wallet reportedly held about 5,402 ETH following the transfers.

Did Verus Protocol officially confirm the exploit?

At the time of publication, Verus Protocol had not publicly confirmed the exploit. Security firms and onchain monitoring platforms were the primary sources reporting the incident.

Cryptocurrency

Image for illustrative purposes only. Not a real photo.

Verus bridge exploit drains $11.6M in crypto

Written by Jon CuthbertPublished May 18, 2026, 7:15 AM

Verus Protocol’s Ethereum bridge was reportedly exploited on Monday after an attacker used a fake cross-chain transfer message to drain at least $11.58 million in cryptocurrency.

Blockaid said its monitoring system detected the exploit after a transaction transferred 1,625 Ether, 147,659 USDC and 103.57 tBTC v2 from the bridge’s reserves to a wallet controlled by the attacker.

“This is NOT an ECDSA bypass, NOT a notary key compromise, NOT a parser/hash-binding bug, IS a missing source-amount validation in checkCCEValues,”

Blockaid said in a statement analysing the exploit.

PeckShield said onchain data showed the stolen assets were later converted into Ether, with the attacker wallet holding approximately 5,402 ETH worth more than $11.4 million.

Security researchers said the exploit resembled previous bridge attacks including the $190 million Nomad Bridge exploit and the $325 million Wormhole exploit from 2022.

Blockchain security firm ExVul said the attacker used a forged cross-chain import payload that passed the bridge’s verification process and triggered multiple fraudulent transfers to the drainer wallet.

The incident followed a separate $10 million exploit confirmed by THORChain on Saturday as decentralised finance platforms continued facing elevated security risks throughout 2026.

At the time of reporting, Ethereum price was $2,117.95.

Verus bridge exploit drains $11.6M in crypto

Frequently asked questions

Verus bridge exploit drains $11.6M in crypto

Frequently asked questions