The Verus Ethereum Bridge has suffered another major security breach, with an attacker stealing about $7.54 million in crypto assets from the same Ethereum bridge contract that was exploited in May.
Blockchain security firm Blockaid detected the exploit on July 23, saying the attacker abused the bridge’s import process to trigger Ethereum payouts that were not backed by matching assets on the source chain.
🚨 Blockaid detected a @VerusCoin Ethereum Bridge exploit on Ethereum.
An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves.
More details in 🧵— Blockaid (@blockaid_) July 23, 2026
Onchain data shows the attack transaction was executed at 03:45 UTC, sending approximately 1,137 ETH along with tBTC, USDC, USDT, EURC, MKR and scrvUSD to an attacker-controlled wallet. Etherscan valued the stolen assets at around $7.54 million at the time of the exploit.
Same bridge, similar exploit drains another $7.5 million
According to Blockaid, the latest attack involved a different transaction and attacker wallet from the May incident, but targeted the same Verus Ethereum Bridge contract and exploited the same import path.
The security firm said the attacker was able to generate Ethereum-side payouts without equivalent assets being locked on the source chain. The receiving wallet was identified as 0xCFd0…2D54.
The exact technical flaw has not yet been confirmed, and a full technical analysis has not yet been released.
This may be a warning for cross-chain bridges
The Verus exploit was one of three major security incidents reported within hours. Onchain tracker Lookonchain said AFX Trade, Verus, and B² Network suffered combined losses of about $35.55 million, including $24.15 million from AFX, $7.54 million from Verus and $3.86 million from B² Network.
Earlier on the same day, an AFX-operated bridge lost more than $24 million in USDC before the attacker moved the funds to Ethereum and converted them into ETH. Offchain Labs said the incident did not affect Arbitrum’s native bridge and was limited to infrastructure operated by a third-party protocol.
The latest Verus breach adds to growing concerns over cross-chain bridge security, where flaws in message verification or contract logic can allow attackers to unlock assets without a valid transfer. Investigators have not confirmed whether any of the stolen funds have been frozen or recovered, and the project’s response remains pending.
Recovery efforts begin as users question Verus response
The Verus team has paused bridge operations and launched an investigation into the latest exploit, but it has not announced a bounty or reimbursement program for affected users. Unlike the May incident, where settlement talks with the attacker helped recover about 75% of the stolen funds, current efforts are focused on tracing the stolen assets after they were reportedly moved through Tornado Cash.
Recovery progress remains limited. The use of Tornado Cash has made it more difficult to track and recover the funds, while the project is expected to be working with blockchain security firms, including Blockaid and PeckShield, as well as relevant authorities. Early updates have also warned users to ignore fake reimbursement offers and other scam attempts exploiting the incident.
The exploit has triggered strong reactions across X, with many users describing the wave of attacks as “hackers’ day” after Verus, AFX Trade and B² Network were all exploited within hours. Others criticized the project’s security measures following the May breach, questioning whether enough had been done to fix the underlying issues.
Enjoyed this? Bookmark DeFi Planet, explore related topics, and follow us on Twitter, LinkedIn, Facebook, Instagram, Threads, and CoinMarketCap Community for seamless access to high-quality industry insights
Take control of your crypto portfolio with DEFI PLANET PRO, DeFi Planet’s suite of analytics tools.
