The Verus Protocol Ethereum bridge suffered an exploit on Sunday evening, with attackers siphoning over $11.5 million in crypto assets by forging cross-chain transfer messages. Blockchain security platform Blockaid first detected the suspicious activity and identified the attacker's wallet as “0x5aBb…D5777”.
Detailed data from PeckShield showed the stolen assets included 103.6 tBTC, 1,625 ETH, and nearly 147,000 USDC. The attacker later swapped the tokens into 5,402 ETH, worth approximately $11.4 million. Before the exploit, the attacker's wallet received 1 ETH via the crypto mixer Tornado Cash, a common practice to obscure transaction origins.
Exploit Details: Forged Cross-Chain Payload Bypasses Verification
GoPlus Security reported that the attacker first sent a low-value transaction to the bridge contract before invoking a function that batch-transferred reserve assets to the drainer wallet. GoPlus said the exploit was “highly likely” tied to cross-chain message validation failure, withdrawal logic bypass, or access control weakness. Blockaid provided a more specific explanation, comparing the incident to the 2022 Nomad Bridge and Wormhole attacks, where fraudulent transfer instructions tricked protocols into releasing reserve funds.
In a follow-up technical assessment, Blockaid ruled out an ECDSA bypass, notary key compromise, or parser/hash-binding bug. Instead, it identified the root cause as “a missing source-amount validation in checkCCEValues,” a flaw that could reportedly be fixed with around 10 lines of Solidity code.
ExVul reached a similar conclusion, stating the attacker used a “forged cross-chain import payload” that successfully passed the bridge's verification process. ExVul recommended that cross-chain proof systems tie transfer execution directly to authenticated payload data before releasing funds, and advised stricter payload validation, layered verification protections, and emergency pause mechanisms for unusual outbound transfers.
DeFi Security in 2026: Bridge Protocols Bear the Brunt
The Verus-Ethereum bridge, launched in 2023, facilitates asset transfers between the Verus network and Ethereum. The Verus Protocol itself debuted in 2018 and uses a hybrid proof-of-work and proof-of-stake consensus model. The Verus team had not publicly commented on the exploit as of press time.
This incident follows a year already marked by major DeFi breaches. According to security tracking data, crypto hackers stole over $168.6 million from 34 DeFi protocols in Q1 2026 alone. April saw two of the largest attacks: the reported $280 million Drift Protocol exploit and the $292 million Kelp exploit. Over the weekend, cross-chain liquidity protocol THORChain also confirmed a separate $10 million exploit, adding to mounting concerns over bridge and interoperability security.
Bridge protocols remain a prime target due to their complexity and role as cross-chain infrastructure. The Verus attack once again highlights that without rigorous source-amount validation, forged messages can trigger catastrophic asset drain.