An attacker stole approximately $7.54 million from the Verus Ethereum bridge on Thursday, marking the second successful exploit of the bridge in about two months. The incident indicates that a vulnerability identified earlier this year may not have been fully remediated, underscoring how known flaws can continue to threaten cross-chain infrastructure.

Verus is a layer-1 blockchain that connects to Ethereum through its bridge contract, enabling users to transfer assets between the two networks. Cross-chain bridges more broadly allow users to lock assets on one blockchain and issue equivalent tokens on another. Because many bridges hold large shared liquidity pools, even a narrow validation failure can lead to multimillion-dollar losses. Blockchain security firm Blockaid said the Verus incident appears to involve the same bug class that has affected some of the largest crypto bridge exploits since 2022.

A repeat exploit against the same contract

According to Blockaid, the attacker abused the bridge’s import mechanism to trigger Ethereum-side payouts that did not match the underlying values on the Verus blockchain. The stolen assets included ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD, with total losses estimated at about $7.54 million.

Blockaid posted details of the incident on X: https://x.com/blockaid_/status/2080143099561496896, https://x.com/blockaid_/status/2080143275659333793, and https://x.com/blockaid_/status/2080143511173611704.

The attack targeted the Verus Ethereum bridge protocol contract at 0x7151D8b4A487F3Fcf131fbfAAeD8A5A5F6b97f63. The funds were traced to the attacker’s wallet at 0xCFd0A2D0A2E3d74C2A08C96A0A4aE7d58eF92D54.

The on-chain evidence is available on Etherscan, including the exploit transaction:

The incident closely resembles the May 2026 Verus bridge hack, in which $11.58 million was drained. Blockaid said both attacks targeted the same contract through the same import route, suggesting that the underlying vulnerability had not been fixed.

Why a small input could trigger a large payout

Security firms Halborn and Merkle Science reached similar conclusions after analyzing the earlier attack.

“The vulnerability was not a cryptographic failure, but a missing validation ensuring that the value committed on the Verus chain matched the value released on Ethereum.” — Rob Behnke, Halborn

Halborn said that even a transaction worth about 1 cent could pass the bridge’s signature and Merkle-proof requirements before the Ethereum smart contract was triggered to execute the transaction and release assets worth millions of dollars. Halborn’s explanation of the May 2026 Verus Ethereum bridge hack is available at

Merkle Science attributed the issue to the checkCCEValues function in the bridge’s code.

“The bridge failed to validate that the source value matched the destination payout, allowing an attacker to spend only minimal fees while withdrawing millions.” — Mir Jalal, Merkle Science

Merkle Science said the problem appeared to stem from approximately 10 missing lines of Solidity validation, which allowed the attacker in the earlier incident to turn about $10 worth of VRSC transaction fees into an $11.58 million payout. Its analysis is available at

Both firms emphasized that the bridge’s cryptography and proof validation operated as intended. The failure was that the contract did not verify whether the value being released on Ethereum was backed by assets on the Verus chain. Merkle Science also noted that the same category of validation failure was responsible for the Wormhole and Nomad bridge exploits in 2022, which resulted in approximately $320 million and $190 million in losses, respectively.

Bridge losses have fallen, but known flaws remain a risk

The Verus exploit comes during a period in which losses from bridge attacks have declined across the crypto sector.

According to TRM Labs, crypto suffered 207 cybersecurity attacks in the relevant six-month period, the highest number recorded for any six-month span. However, total losses fell from $2.3 billion to $972 million compared with the same period in 2025, while the median hack size declined to roughly $219,000. TRM Labs published its findings at

Bridge security has also improved in recent years. Immunefi reported that bridge hacks accounted for 73% of DeFi losses in 2022, but only 3% in 2025, indicating improvements in audits and bridge design across the market. The Immunefi report is available at

Even so, the Verus breach shows that broader industry progress does not eliminate the danger of unresolved vulnerabilities. A flaw first highlighted after the May exploit appears to have been used again, reinforcing the importance of addressing known defects rather than assuming they no longer pose a threat.

Verus has not published an official post-mortem for Thursday’s incident, leaving it unclear whether the bridge has been paused or whether a contract upgrade addressing the validation gap is being prepared. After the May incident, Merkle Science advised users not to use the bridge until the faulty validation had been fixed and approved by an independent auditor. Users were urged to avoid bridge transfers until the project confirmed that the remediation work had been completed.