NewsCompaniesFlawsGuides
Get the app
HighClosedUpdated

Verus–Ethereum bridge loses about US$11.7 million; 75% returned, full restitution unconfirmed

The Verus–Ethereum bridge lost about US$11.7 million in May; roughly 75% was returned. Holders of bridged ETH, bitcoin and related investment baskets faced losses. Check restitution with Verus or your custodian before moving more funds through the bridge.

What to do

If you held bridged ETH, tBTC or baskets containing them, ask Verus or your custodian to confirm your balance adjustments and restitution credits. Avoid further bridge transfers until Verus confirms the relevant contracts are upgraded and service has safely resumed. If you run a Verus node, update to v1.2.18, the latest official release found in this review.

What’s happening

On 17–18 May, an attacker drained ETH, tokenised bitcoin and USDC worth approximately US$11.7 million from the Verus–Ethereum bridge. BlockSec found that the Ethereum contract accepted supplementary cross-chain data as an authorised transfer, allowing payouts that should have been rejected. The Verus network halted. About 75% of the stolen funds was subsequently returned under a settlement that let the attacker retain 1,350 ETH. Verus’s July restoration plan identified a remaining 26.6% shortfall in ETH and tBTC backing, affecting direct holders and investment baskets containing those assets. It proposed balance reductions and restitution credits supported by future bridge fees. A separate July attack caused additional losses. Further node security releases followed, but September’s official release still described Ethereum contract upgrades as forthcoming. As of 3 November, the reviewed sources did not confirm a completed bridge fix, reopening after the later attack, or full reimbursement of May’s losses.

What
Breach
Affects
Verus–Ethereum cryptocurrency bridge
Fixed in
Nothing to patch
Since
18 May 2026
Closed
17 Sept 2026

Timeline

  1. Vendor revised

    Verus released v1.2.18 and urged all node operators to update. Its announcement still described Ethereum contract upgrades as forthcoming, so this release did not establish a completed bridge fix or reopening.

  2. Vendor revised

    Verus released v1.2.17-3 with further security changes and acknowledged the latest bridge hack. It said Ethereum contracts were still being prepared for an upgrade.

  3. Update

    A separate bridge attack was reported with approximately US$7.54 million stolen. Blockaid said it involved a different attacker but the same contract, import path and vulnerability class as May; this was an additional loss.

  4. Update

    Verus announced another precautionary pause of cross-chain functions and released v1.2.17-2 for a separate vulnerability. It said that vulnerability had never been exploited.

  5. Update

    Verus released v1.2.17-1 to enable voting on Ethereum contract upgrades and help reopen the bridge. The announcement described the reopening process rather than confirming its completion.

  6. Update

    Verus released v1.2.17 with a restoration plan scheduled to begin on 7 July. It put the remaining ETH and tBTC backing shortfall at about 26.6% and proposed balance adjustments plus restitution credits funded by future bridge fees.

  7. Update

    PeckShield reported that the attacker had returned 4,052.4 ETH, approximately 75% of the stolen funds, following Verus’s settlement offer. The attacker retained 1,350 ETH as the offered bounty.

  8. Made publicNothing to patch

    The Verus–Ethereum bridge attack was reported, with PeckShield identifying 103.6 tBTC, 1,625 ETH and 147,000 USDC stolen. Verus said its network had halted while developers investigated.

Sources

  1. Verus v1.2.17 — bridge restoration and recovery updateVerus · 3 July 2026
  2. Verus official release history, including v1.2.18Verus · 17 Sept 2026
  3. Verus v1.2.17-3 — security upgrade and bridge incident updateVerus · 1 Aug 2026
  4. ~$104.6M Lost: Verus, RetoSwap & More | BlockSec WeeklyBlockSec · 27 May 2026
  5. Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: BlockaidThe Block · 18 May 2026
  6. Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analystThe Block · 22 May 2026
  7. New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: BlockaidThe Block · 23 July 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS