The decentralized finance (DeFi) space has been rocked by another major exploit. This time, the Verus project’s bridge connecting to the Ethereum blockchain was targeted in a sophisticated attack exploiting a vulnerability in cross-chain transfers. Following intense negotiations, the majority of the stolen crypto assets were returned to the project by the attacker.
Most of the stolen funds returned
According to blockchain security firm PeckShield, the attacker transferred 4,052 ETH to the Verus team’s wallet, representing roughly $8.5 million at current market value. As part of the settlement reached, the attacker was allowed to keep 1,350 ETH, valued around $2.8 million, as a reward for reporting the vulnerability.
Verus developers, reeling from the breach, swiftly made a public offer for reconciliation. They stated that if 4,052.4 ETH was returned, the remaining funds would be recognized as a legitimate white hat bounty. The attacker accepted the terms, ultimately restoring approximately 75% of the compromised assets to the Verus team.
Security flaw in the Verus bridge revealed
The attack stemmed from a flaw in the cross-chain bridge connecting Verus and Ethereum. This specific vulnerability allowed the attacker to deceive the bridge mechanism and authorize illicit transfers. Bridges enabling asset transfers between separate blockchains hold large liquidity pools, making them an attractive target for malicious actors.
Mini glossary: A cross-chain bridge is a smart contract-based infrastructure allowing cryptocurrency transfers across different blockchain networks. These solutions typically enable asset flows between two independent chains, but their vulnerabilities can result in significant security risks.
DeFi security under spotlight after recent attacks
The Verus incident comes amid a period of persistent security breaches in decentralized finance. Data from DefiLlama shows DeFi protocols lost a combined $634 million in April alone. Among the most notable attacks were a $280 million exploit on Drift Protocol and a $293 million loss at Kelp Protocol.
| Incident | Date | Loss Amount |
|---|---|---|
| Drift Protocol exploit | April 2024 | $280 million |
| Kelp Protocol breach | April 2024 | $293 million |
| Verus bridge attack | May 2024 | $11.3 million (1,350 ETH left as bounty) |
Though total losses dropped to around $38 million in May, ongoing vulnerabilities in cross-chain infrastructures and smart contracts continue to undermine trust in decentralized projects.
Ongoing risks in an expanding DeFi ecosystem
As blockchain technology is adopted more widely, DeFi projects face escalating security responsibilities. The massive volume of assets moving through DeFi protocols and cross-chain bridges means the fallout from attacks is only increasing in scale.
The Verus team emphasized that the attacker’s decision to return most funds represents an important step toward rebuilding community trust. They also announced new initiatives to enhance bridge security practices going forward.
Experts stress that DeFi projects must invest further in smart contract security, conduct regular code audits, and strengthen the protection of cross-chain infrastructure to prevent future attacks.
