Verus Ethereum Bridge Drained Of $7.54M In Second Exploit

An attacker drained approximately $7.54 million from the Verus Ethereum Bridge on Thursday by using its import path to trigger payouts that were not backed by assets on the Verus network.

The unauthorized withdrawals removed ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD from the bridge’s Ethereum reserves. PeckShield separately placed the loss near $7.5 million.

The exploit targeted the process used to release assets on Ethereum after a cross-chain transfer is validated. A malicious import passed through the bridge’s verification route and instructed its contracts to pay out real reserves without a corresponding export or deposit on Verus.

Blockaid had not disclosed whether the attacker used one transaction or a series of imports, while downstream swaps and the current balance of the receiving addresses remained under review.

Verus Bridge Suffers Second Major Drain

The attack is the second major loss involving the Verus Ethereum Bridge in just over two months.

A May 17 transaction removed 1,625.36 ETH, 103.56 tBTC and 147,658 USDC from the bridge, putting the initial loss near $11.56 million. The attacker converted the assets into roughly 5,402 ETH before returning 4,052 ETH under a recovery agreement and retaining 1,350 ETH as a bounty.

Verus later introduced tighter transaction proofs and prepared replacement Ethereum contracts as part of its bridge restoration process. The July exploit raises fresh questions over whether the latest withdrawal reached the upgraded contracts or another component of the import system.

Neither Blockaid nor PeckShield identified a private-key compromise or stolen validator credentials in their initial alerts. The known attack path centered on the bridge’s handling of imported transfer instructions.

Protocol Exploits Accelerate Across DeFi

The Verus drain followed a $24.15 million USDC withdrawal from AFX Trade’s Arbitrum bridge, where an unauthorized transaction cleared the bridge’s validator approval and dispute process.

Hours later, an attacker sold 8.59 million B2 taken from B² Network for 5,409 BNB, realizing about $3.01 million after slippage.

The attacks came one day after an oracle failure at 42DAO allowed an attacker to extract $915,000 and push Balance Coin down more than 99%.