Verus-Ethereum Bridge (July 2026) hack — July 2026

The Verus-Ethereum bridge was drained for the second time in ten weeks on 23 July 2026, in a single transaction at about 03:45 UTC. Blockaid, which detected it, said roughly $7.54 million left the Ethereum-side contract: 1,137.45 ETH, 71.5 tBTC v2, 149,275 USDC, 78,300 USDT, 31,475 EURC, 59.43 MKR and 92,784 scrvUSD.

The bridge's submitImports function processes proofs of transfers made on the Verus chain and releases the matching assets on Ethereum. It did not verify that the value actually committed on the Verus side matched the value paid out. Reported analyses say the attacker submitted an import backed by a negligible VRSC transaction and collected the full basket. Rob Behnke of Halborn characterised the flaw as a missing validation rather than a cryptographic failure; analysts at Merkle Science and SlowMist described the same class of weakness.

Blockaid said the July attack used the same contract, the same entry path and the same class of bug as a May 2026 exploit of the bridge that took about $11.58 million. In that earlier case the attacker returned roughly 4,052 ETH, worth about $8.5 million, and kept about 1,350 ETH as a bounty.

The attacker swapped the stolen assets into roughly 3,916 ETH and moved them through Tornado Cash in batches. At the time of reporting Verus had issued no statement, patch, post-mortem or compensation plan, and CoinDesk put the project's total value locked at about $9 million, down from roughly $100 million at the start of 2025.