The Verus Ethereum Bridge suffered another major security breach on July 23, when attackers stole approximately $7.54 million in crypto assets, marking the protocol's second exploit in just over two months.

Blockchain security firm Blockaid said the attacker abused the bridge's submitImports function to trigger payouts on Ethereum without corresponding assets being locked on the Verus blockchain. That allowed funds to be withdrawn from the bridge's reserves through what investigators described as unbacked Ethereum-side payouts.

Independent security researcher exvulsec confirmed the exploit shortly after it was detected. The incident has renewed questions over whether the vulnerability involved in Verus' $11.58 million exploit in May was fully addressed, while also underscoring the continuing security risks facing cross-chain bridges in decentralized finance (DeFi) — a category that has accounted for some of the largest losses in crypto history, including the $620 million Ronin Network hack and the $320 million Wormhole exploit.

🚨 Blockaid detected a @VerusCoin Ethereum Bridge exploit on Ethereum. An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves. More details in 🧵 — Blockaid (@blockaid_) July 23, 2026

Verus Ethereum Bridge Loses 1,137 ETH in $7.54 Million Hack

According to on-chain data, the exploit occurred at approximately 03:45 UTC and drained seven assets from the bridge's Ethereum reserves: 1,137 ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. The stolen assets were valued at roughly $7.54 million at the time of the attack.

Investigators said the attacker rapidly swapped the stolen tokens through decentralized exchanges and consolidated them into nearly 3,916 ETH. Portions of the funds were then routed through Tornado Cash, an Ethereum-based mixing service sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) since 2022, a step that significantly complicated asset recovery efforts.

Same Verus Bridge Contract Targeted Again

Blockaid said the latest attack targeted the same bridge contract, the same entry point, and the same type of vulnerability exploited in the May incident, though this time the activity came from a new attacker wallet.

Verus has not yet published a technical post-mortem. Security experts said the vulnerability appeared to allow Ethereum-side payments without adequate confirmation that assets had been locked on the other chain — a class of flaw known as a cross-chain verification failure, where a bridge releases funds based on messages or signals that have not been properly validated against the source chain's state.

The repeat incident has raised questions about whether the earlier security issue was fully resolved before bridge operations resumed. In May, the attacker in that earlier breach returned around 4,052 ETH, representing approximately 75% of the stolen funds, after reaching an agreement with Verus.

Cross-Chain Bridge Security Faces Renewed Scrutiny

The Verus incident came amid a wider series of attacks affecting AFX Trade and B² Network. According to on-chain tracker Lookonchain, the combined losses from those incidents totaled about $35.55 million.

Security experts said the attacks show how cross-chain bridges remain frequent targets when logical errors exist in cross-chain messaging and validation systems. Bridges are designed to move value between blockchains, but that design often requires complex verification processes across multiple networks. According to data compiled by DeFiLlama and other trackers, bridge exploits have cumulatively accounted for billions of dollars in losses since 2021, making them one of the most targeted categories of DeFi infrastructure.

Verus Halts Bridges During Investigation

Verus has halted all bridges while the investigation continues. As of the report, the developers had not released a compensation plan or a detailed technical explanation of the hack.

The unresolved issues include how the validation process failed, whether the same vulnerability from May remained exploitable, and where the missing funds ultimately moved after the swaps and Tornado Cash transfers. Until Verus releases a detailed update, the incident is likely to remain a focus of criticism over the bridge's security controls and over the broader practice of resuming bridge operations after an exploit without independent audits or public verification of remediation.