The Verus Ethereum Bridge has been targeted by a major security breach for the second time in just over two months, resulting in the theft of approximately $7.54 million in various crypto assets. The incident occurred on July 23 when attackers exploited a vulnerability, once again raising concerns about the security of cross-chain protocols in decentralized finance (DeFi).
Attacker Drains Bridge’s Ethereum Reserves
The breach allowed the attacker to abuse the bridge’s submitImports function, which triggered Ethereum-side payouts without equivalent assets being locked on the Verus blockchain. This vulnerability enabled the unauthorized extraction of funds from the bridge’s reserves.
Blockchain security firm Blockaid and independent researcher exvulsec both confirmed and investigated the exploit. According to on-chain data, roughly 1,137 ETH, as well as tBTC, USDC, USDT, EURC, MKR, and scrvUSD, were drained from the bridge reserves at around 03:45 UTC. The stolen assets were quickly swapped through decentralized exchanges, then consolidated into nearly 3,916 ETH before parts of the funds were routed through Tornado Cash.
Mini dictionary: Tornado Cash, a decentralized non-custodial privacy solution on Ethereum, is designed to break the on-chain link between source and destination addresses, making transaction tracing more difficult.
| Asset | Amount stolen | Estimated value |
|---|---|---|
| ETH | 1,137 | Included in $7.54M total |
| tBTC | Unknown | |
| USDC | Unknown | |
| USDT | Unknown | |
| EURC | Unknown | |
| MKR | Unknown | |
| scrvUSD | Unknown |
Investigators noted that by exploiting the same contract, function entry point, and vulnerability as a previous May breach, the attacker bypassed standard cross-chain verification and triggered unbacked payouts, draining several digital assets from Verus’ Ethereum bridge reserves.
Recurring Security Flaws and Recent History
The latest breach revived scrutiny over Verus’ handling of a previous exploit in May, which resulted in an $11.58 million loss. Experts stated that this attack exploited the exact vulnerability from the earlier incident, indicating that core issues may have remained unaddressed. Blockaid observed that while this latest event involved a different attacker wallet, the method and targeted contract remained unchanged.
Following the May attack, the same attacker returned 4,052 ETH—about 75% of the stolen funds—after reaching an agreement with Verus. Despite that partial restitution, the repetition of the exploit has heightened doubts regarding the bridge’s security remediation process.
Experts pointed out that the repeated vulnerability likely resulted from an incomplete technical fix after the earlier breach, leaving Verus exposed to additional attacks. There is growing pressure for the protocol team to publish a thorough incident report and technical breakdown.
Ongoing Investigations and Broader Risks
The Verus incident is one of several recent DeFi bridge attacks highlighted by on-chain monitoring services. Lookonchain reported that combined losses from incidents involving Verus, AFX Trade, and B² Network have climbed to approximately $35.55 million.
Mini dictionary: Lookonchain is an on-chain analytics platform known for monitoring blockchain transactions and identifying patterns related to hacks, large movements, and abnormal activities.
Security analysts explained that bridge protocols are increasingly targeted due to logical flaws in cross-chain messaging mechanisms, which, if exploited, can allow fund withdrawals without equivalent collateralization.
Next Steps for Verus and Users
Amid the investigation, Verus halted all bridge operations but has not announced a compensation plan or released a detailed technical report. The absence of a clear official explanation has drawn criticism from the user community.
Observers expect the Verus team to prioritize closing the technical vulnerability, improve their validation process, and offer a roadmap to locate and potentially recover missing assets. Until these steps are made public, scrutiny around trust and transparency in the protocol will likely continue.
