{"id":"verus-ethereum-bridge-theft-may-2026","category":"breach","status":"closed","title":"Verus–Ethereum bridge loses about US$11.7 million; 75% returned, full restitution unconfirmed","tldr":"The Verus–Ethereum bridge lost about US$11.7 million in May; roughly 75% was returned. Holders of bridged ETH, bitcoin and related investment baskets faced losses. Check restitution with Verus or your custodian before moving more funds through the bridge.","summary":"On 17–18 May, an attacker drained ETH, tokenised bitcoin and USDC worth approximately US$11.7 million from the Verus–Ethereum bridge. BlockSec found that the Ethereum contract accepted supplementary cross-chain data as an authorised transfer, allowing payouts that should have been rejected. The Verus network halted. About 75% of the stolen funds was subsequently returned under a settlement that let the attacker retain 1,350 ETH. Verus’s July restoration plan identified a remaining 26.6% shortfall in ETH and tBTC backing, affecting direct holders and investment baskets containing those assets. It proposed balance reductions and restitution credits supported by future bridge fees. A separate July attack caused additional losses. Further node security releases followed, but September’s official release still described Ethereum contract upgrades as forthcoming. As of 3 November, the reviewed sources did not confirm a completed bridge fix, reopening after the later attack, or full reimbursement of May’s losses.","action":"If you held bridged ETH, tBTC or baskets containing them, ask Verus or your custodian to confirm your balance adjustments and restitution credits. Avoid further bridge transfers until Verus confirms the relevant contracts are upgraded and service has safely resumed. If you run a Verus node, update to v1.2.18, the latest official release found in this review.","product":"Verus–Ethereum cryptocurrency bridge","audience":"both","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["verus","ethereum","crypto","bridge","theft","fund-recovery"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Verus v1.2.17 — bridge restoration and recovery update","url":"https://github.com/VerusCoin/VerusCoin/releases/tag/v1.2.17","by":"Verus","date":"2026-07-03"},{"kind":"advisory","title":"Verus official release history, including v1.2.18","url":"https://github.com/VerusCoin/VerusCoin/releases","by":"Verus","date":"2026-09-17"},{"kind":"advisory","title":"Verus v1.2.17-3 — security upgrade and bridge incident update","url":"https://github.com/VerusCoin/VerusCoin/releases/tag/v1.2.17-3","by":"Verus","date":"2026-08-01"},{"kind":"research","title":"~$104.6M Lost: Verus, RetoSwap & More | BlockSec Weekly","url":"https://blocksec.com/blog/web3-security-verus-bridge-retoswap-more","by":"BlockSec","date":"2026-05-27"},{"kind":"news","title":"Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: Blockaid","url":"https://www.theblock.co/news/ecosystems/2026-05-17-verus-ethereum-bridge-exploit-401571","by":"The Block","date":"2026-05-18"},{"kind":"news","title":"Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst","url":"https://www.theblock.co/news/ecosystems/2026-05-22-verus-bridge-exploiter-returns-4052-eth-402319","by":"The Block","date":"2026-05-22"},{"kind":"news","title":"New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: Blockaid","url":"https://www.theblock.co/news/ecosystems/2026-07-23-new-verus-ethereum-bridge-attack-409489","by":"The Block","date":"2026-07-23"}],"started":"2026-05-18","closed":"2026-09-17","created":"2026-11-03T21:33:23.391Z","updated":"2026-11-03T21:33:23.391Z","cve_notes":[],"timeline":[{"at":"2026-09-17","added":"2026-11-03T21:25:43.261Z","kind":"vendor-revised","text":"Verus released v1.2.18 and urged all node operators to update. Its announcement still described Ethereum contract upgrades as forthcoming, so this release did not establish a completed bridge fix or reopening.","url":"https://github.com/VerusCoin/VerusCoin/releases","by":"Verus","patch":null},{"at":"2026-08-01","added":"2026-11-03T21:25:43.261Z","kind":"vendor-revised","text":"Verus released v1.2.17-3 with further security changes and acknowledged the latest bridge hack. It said Ethereum contracts were still being prepared for an upgrade.","url":"https://github.com/VerusCoin/VerusCoin/releases/tag/v1.2.17-3","by":"Verus","patch":null},{"at":"2026-07-23","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"A separate bridge attack was reported with approximately US$7.54 million stolen. Blockaid said it involved a different attacker but the same contract, import path and vulnerability class as May; this was an additional loss.","url":"https://www.theblock.co/news/ecosystems/2026-07-23-new-verus-ethereum-bridge-attack-409489","by":"The Block","patch":null},{"at":"2026-07-16","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Verus announced another precautionary pause of cross-chain functions and released v1.2.17-2 for a separate vulnerability. It said that vulnerability had never been exploited.","url":"https://github.com/VerusCoin/VerusCoin/releases","by":"Verus","patch":null},{"at":"2026-07-12","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Verus released v1.2.17-1 to enable voting on Ethereum contract upgrades and help reopen the bridge. The announcement described the reopening process rather than confirming its completion.","url":"https://github.com/VerusCoin/VerusCoin/releases","by":"Verus","patch":null},{"at":"2026-07-03","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"Verus released v1.2.17 with a restoration plan scheduled to begin on 7 July. It put the remaining ETH and tBTC backing shortfall at about 26.6% and proposed balance adjustments plus restitution credits funded by future bridge fees.","url":"https://github.com/VerusCoin/VerusCoin/releases/tag/v1.2.17","by":"Verus","patch":null},{"at":"2026-05-22","added":"2026-11-03T21:25:43.261Z","kind":"other","text":"PeckShield reported that the attacker had returned 4,052.4 ETH, approximately 75% of the stolen funds, following Verus’s settlement offer. The attacker retained 1,350 ETH as the offered bounty.","url":"https://www.theblock.co/news/ecosystems/2026-05-22-verus-bridge-exploiter-returns-4052-eth-402319","by":"The Block","patch":null},{"at":"2026-05-18","added":"2026-11-03T21:25:43.261Z","kind":"disclosed","text":"The Verus–Ethereum bridge attack was reported, with PeckShield identifying 103.6 tBTC, 1,625 ETH and 147,000 USDC stolen. Verus said its network had halted while developers investigated.","url":"https://www.theblock.co/news/ecosystems/2026-05-17-verus-ethereum-bridge-exploit-401571","by":"The Block","patch":"na"}],"url":"https://hard.fyi/live/verus-ethereum-bridge-theft-may-2026/","json":"https://hard.fyi/api/live?id=verus-ethereum-bridge-theft-may-2026"}