Verus Ethereum Bridge Vulnerability Leads to $7.5 Million Crypto Theft*
**
Verus Ethereum Bridge Vulnerability Leads to $7.5 Million Crypto Theft**
The Verus Ethereum cross-chain bridge has suffered another attack, resulting in the theft of approximately $7.54 million worth of cryptocurrency. The attacker exploited a vulnerability that appears to be similar to the one used in a previous hack in May 2026, suggesting that the issue may not have been fully resolved.
The root cause was not a failure of cryptographic security, but a flaw in the smart contract’s transaction validation logic. The Verus Ethereum bridge failed to verify whether the amount of tokens issued on the Ethereum network matched the value of assets locked on the Verus network. This allowed the attacker to perform a transaction with a very small amount and receive millions of dollars in assets in return.
According to blockchain security company Blockaid, the attacker exploited the bridge’s import mechanism and forced it to release funds that were not backed by sufficient reserves on the Verus network. The stolen assets included ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. The total damage was estimated at around $7.54 million.
Security experts linked the incident to a previous attack in May 2026, when approximately $11.58 million was drained through the same contract. In both cases, attackers used a similar import route, indicating that developers may not have completely fixed the vulnerability or failed to replace the affected smart contract.
Earlier security reviews by Halborn and Merkle Science found that the bridge’s cryptographic mechanisms, digital signatures, and Merkle proofs were functioning correctly. The actual weakness was located in the amount verification process. The contract confirmed that transactions were authentic but did not compare whether the value of assets locked on the original network matched the amount released on the destination network.
According to Merkle Science, the vulnerability could have been prevented by adding roughly ten lines of Solidity code to validate transaction amounts. During the May attack, the hacker spent only about $10 in VRSC fees and managed to steal assets worth $11.58 million. Halborn noted that even a transaction worth around one cent could pass the existing checks and trigger a payout worth millions of dollars.
Similar vulnerabilities have previously been exploited in major attacks on cross-chain bridges such as Wormhole and Nomad in 2022. In these incidents, attackers did not break cryptographic systems but instead took advantage of missing validation logic in smart contracts.
The Verus team has not yet released a detailed analysis of the latest attack. After the May incident, Merkle Science recommended avoiding the bridge until developers fixed the verification issue and confirmed the security of the updated system through an independent audit.
This incident once again highlights that the security of cross-chain bridges depends not only on strong cryptography but also on properly designed smart contract logic and thorough verification of every asset transfer.