Verus-Ethereum bridge drained of about US$7.54 million a second time through the same flaw as May
The Verus-Ethereum bridge lost about US$7.54M on 23 July, 66 days after a US$11.58M theft through the same flaw. No fix, recovery or Verus statement was found. Don't move funds across this bridge, and ignore anyone offering reimbursement.
If you hold funds on or bridged through Verus, don't send more across the Verus-Ethereum bridge until Verus publishes a fix and post-mortem. Treat anyone offering compensation by message as a scammer, and check Verus's official channels for updates.
What’s happening
On 23 July 2026 the Verus-Ethereum bridge, which moves crypto between the Verus and Ethereum blockchains, was drained of about US$7.54 million. Security firm Blockaid said the attacker used the bridge's import path to trigger payouts on Ethereum that had no matching assets behind them. The stolen assets were ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD. Blockaid said it was the same contract, entry path and type of flaw as a May 2026 attack that took about US$11.58 million, but from a different attacker wallet. Combined losses are reported at about US$19.1 million. CertiK reported the proceeds were swapped for 3,916.1 ETH and deposited into the Tornado Cash mixer. In May the attacker returned most of the funds for a bounty; no return has been reported for July. As of the sources read, no confirmed fix, relaunch, post-mortem, reimbursement plan or Verus statement on the July attack was found, so patch status is unconfirmed. This affects bridge users and liquidity holders, not ordinary phone or computer software.
- What
- Breach
- Affects
- Verus-Ethereum Bridge (Verus blockchain to Ethereum cross-chain bridge)
- Fixed in
- No fix yet
- Since
- 23 July 2026
- Closed
- 23 July 2026
Timeline
- UpdateNothing to patch
crypto.news reported the exploit transaction landed at 03:45 UTC, the exact root cause was still under investigation, and no freeze, return, remediation plan or fix was reported.
- UpdateNothing to patch
Coverage put combined losses from the two attacks at about US$19.1 million. Analysts said the bridge checked signatures and proofs but not whether a payout matched assets actually locked on the Verus side. Reports did not say whether Verus had responded.
- Wider attacksNothing to patch
A second attack on the same bridge contract took about US$7.54 million (ETH, tBTC, USDC, USDT, EURC, MKR, scrvUSD). Blockaid said it used the same contract, entry path and flaw type as May, from a different attacker wallet. CertiK said the proceeds were swapped to 3,916.1 ETH and sent to Tornado Cash.
- Made publicNothing to patch
The Verus-Ethereum bridge lost about US$11.58 million in ETH, USDC and tBTC to a forged cross-chain transfer. Verus paused its network, offered a bounty if the funds came back, and warned that anyone offering reimbursement was a scammer.
Sources
- New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: BlockaidThe Block · 23 July 2026
- Verus Ethereum bridge hacked again for $7.54M after May exploitcrypto.news · 23 July 2026
- Verus Bridge Suffers Second Exploit in 66 Days as Flaw Pushes Total Losses to $19.1MBitcoin.com News · 23 July 2026
- Verus Network Paused Following Ethereum Bridge Attack, Offers Bounty for Fund ReturnKuCoin News · 18 May 2026