{"investigation":{"slug":"verus-protocol-ethereum-bridge","entity_name":"Verus Protocol Ethereum Bridge","trust_score":30,"severity_base":31,"score_modifier":-1.4,"confidence":0.85,"status":"published","content_type":"investigation","summary":"The Verus-Ethereum cross-chain bridge, part of the Verus Protocol (VRSC) co-founded by former Microsoft Technical Fellow Michael Toutonghi, was exploited twice in 2026: once on May 18 for approximately $11.58 million and again on July 23 for approximately $7.54 million, both via the same underlying flaw in the bridge's value-validation logic. The May attacker returned roughly 75% of the stolen funds in exchange for a bounty, but those recovered funds were redeposited into the still-unpatched bridge, which was drained again weeks later by a second, apparently unrelated attacker. Verus has not published a formal post-mortem of either incident as of the most recent reporting reviewed.","sections":[{"content":"Verus Protocol is a multi-chain, proof-of-work-based blockchain network offering identity, privacy, and a Public Blockchains-as-a-Service (PBaaS) framework. Its native token is VRSC (VerusCoin). According to a Paris Blockchain Week speaker biography, Michael Toutonghi has been a co-founder, inventor, lead developer, and designer of the Verus Protocol since 2018. Toutonghi is a former Microsoft Technical Fellow (one of a small number of such titled engineers at the company) who led the Windows 95 kernel architecture team and co-founded Microsoft's .NET platform effort before later serving as CTO of Parallels. Coinbase describes VerusCoin as launched as a community project with no initial coin offering or premine. The Verus-Ethereum bridge is a cross-chain component that allows value (ETH, tBTC, USDC and other assets) to move between the Verus chain and Ethereum.","heading":"Overview and Background","sources":[{"url":"https://parisblockchainweek.com/speaker-2026/michael-toutonghi","name":"Michael Toutonghi speaker bio, Paris Blockchain Week","type":"other","credibility":2},{"url":"https://redmondmag.com/Articles/2011/12/01/Parallels-Adds-Microsoft-Technical-Fellow.aspx","name":"Parallels Adds Microsoft Technical Fellow to Cloud Division","type":"news_article","credibility":2},{"url":"https://www.coinbase.com/price/veruscoin","name":"VerusCoin price page, Coinbase","type":"other","credibility":2}],"severity":"low"},{"content":"On the night of May 17 into May 18, 2026, an attacker exploited the Verus-Ethereum bridge, draining approximately $11.58 million in assets, reported by security firms including Blockaid, PeckShield, and GoPlus. Merkle Science's analysis states the attack occurred 'on the night of 17–18 May 2026.' The Block reported the exploit was first flagged by Blockaid in a post made late on May 17, with the drain confirmed into the early hours of May 18 (Eastern time). Stolen assets, per PeckShield, totaled roughly 1,625 ETH, 103.6 tBTC, and 147,000 USDC, which the attacker consolidated into approximately 5,402 ETH. The attacker's wallet was reportedly funded via Tornado Cash roughly 14 hours before the attack, according to PeckShield as cited by The Block.","heading":"First Exploit — May 18, 2026 (approximately $11.58 million)","sources":[{"url":"https://www.theblock.co/post/401571/verus-ethereum-bridge-exploit","name":"Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: Blockaid","type":"news_article","credibility":2},{"url":"https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack","name":"Hack Track: The $11.58M Verus Bridge Hack","type":"research","credibility":2},{"url":"https://cryptopotato.com/hacker-steals-over-11m-from-verus-ethereum-bridge/","name":"Hacker Steals Over $11M From Verus-Ethereum Bridge","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Independent security researchers, including Blockaid and Merkle Science, attributed the root cause to a missing source-amount validation in the bridge's checkCCEValues function. The bridge verified notary signatures, Merkle proofs, and hash bindings on cross-chain messages, but allegedly never confirmed that the value committed on the Verus source chain actually backed the payout claimed on the Ethereum side. This allowed the attacker to submit a cross-chain import payload with empty or falsified source-side totals for roughly $10 in VRSC transaction fees and then call submitImports() on Ethereum to extract bridge reserves. Blockaid stated the fix for this gap was approximately ten lines of Solidity code. Verus had not published an official technical post-mortem as of the reporting reviewed, so this root-cause analysis rests on third-party security researchers rather than the project itself.","heading":"Technical Vulnerability Analysis","sources":[{"url":"https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack","name":"Hack Track: The $11.58M Verus Bridge Hack","type":"research","credibility":2},{"url":"https://www.mitrade.com/ae-en/insights/news/live-news/article-3-1929025-20260723","name":"Verus bridge hacked again for $7.54M as an old bug class keeps draining crypto","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/verus-ethereum-bridge-exploited-again-7-54m","name":"NewsCrypto: Verus Ethereum Bridge Hit Again for $7.54 Million as Prior Bug Class Remains Unfixed","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Following the May exploit, Verus reportedly offered the attacker a 1,350 ETH bounty (roughly $2.8 million at the time) in exchange for returning 4,052 ETH within 24 hours and a commitment not to pursue charges or further investigation. PeckShield, cited by The Block and CoinTelegraph, confirmed on-chain that the attacker transferred 4,052.4 ETH — about 75% of the stolen funds — to a Verus-controlled address, while keeping 1,350 ETH as the bounty. The Block reported that Verus had not issued a formal public acknowledgment of the returned funds as of its reporting, which is a discrepancy with at least one other outlet's claim that the team confirmed the settlement; that claim could not be independently corroborated and is treated here as unverified.","heading":"Partial Recovery and Bounty Settlement — Reported May 22, 2026","sources":[{"url":"https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth","name":"Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/verus-bridge-exploiter-returns-8-5m-keeps-2-8m-as-bounty-reward/","name":"Verus Bridge Exploiter Returns $8.5M, Keeps $2.8M as Bounty Reward","type":"news_article","credibility":2},{"url":"https://coincentral.com/verus-recovers-4052-eth-as-bridge-hacker-keeps-2-8m-bounty/","name":"Verus recovers 4,052 ETH as bridge hacker keeps $2.8M bounty","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On-chain records compiled by security researchers and cited by Rekt indicate that the recovered ETH was redeposited into the same Verus-Ethereum bridge contract on July 8, 2026, as part of a bridge restoration update, before the underlying checkCCEValues validation gap had been structurally fixed. One source reports roughly 1,192 ETH moved from the recovery address back into the bridge contract on that date; figures on the exact amount reloaded vary between sources and should be treated with caution. This decision to restore liquidity to an unpatched bridge preceded a second exploit roughly two weeks later. Merkle Science had separately advised users after the May incident to avoid the bridge until the faulty validation was fixed and independently audited.","heading":"Governance Failure — Funds Reloaded Before the Flaw Was Fixed","sources":[{"url":"https://rekt.news/veruscoin-rekt","name":"VerusCoin - Rekt","type":"research","credibility":2},{"url":"https://usethebitcoin.com/news/verus-ethereum-bridge-hack/","name":"Verus Ethereum Bridge Hack Drains $7.54M","type":"news_article","credibility":2}],"severity":"high"},{"content":"On July 23, 2026, Blockaid detected a new attack on the Verus-Ethereum bridge. AMBCrypto reported that 'Blockchain security firm Blockaid detected a new attack on the Verus-Ethereum Bridge on the 23rd of July.' The attacker drained approximately $7.54 million (CertiK estimated $7.53 million) using the same bridge contract and import path exploited in May, which Blockaid said indicated the underlying vulnerability class had not been fixed. Blockaid stated the second attacker used a new wallet and appeared unconnected to the May attacker. Stolen funds were reportedly converted to approximately 3,916 ETH and sent to Tornado Cash. This second attack occurred as part of a broader cluster of DeFi exploits that day; CoinDesk reported that Bitcoin- and Ethereum-linked protocols lost a combined $35 million across multiple attacks within hours of each other on or around July 23, 2026.","heading":"Second Exploit — July 23, 2026 (approximately $7.54 million)","sources":[{"url":"https://www.theblock.co/post/409489/new-verus-ethereum-bridge-attack","name":"New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: Blockaid","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/verus-ethereum-bridge-hit-by-second-hack-as-7-54m-vanishes/","name":"Verus Ethereum Bridge Hit by Second Hack as $7.54M Vanishes","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart","name":"Bitcoin, Ethereum-linked protocols lose $35 million in multiple attacks hours apart","type":"news_article","credibility":1}],"severity":"critical"},{"content":"Verus's total value locked reportedly fell sharply across 2026 following the two bridge exploits. One Chinese-language market report, drawing on DefiLlama-style figures, stated the protocol held close to $100 million in TVL at the start of 2025 and that, as of July 23, 2026 (following the second hack), its TVL had fallen to approximately $9 million, as users withdrew assets after repeated incidents. This specific TVL figure comes from a single aggregator-style source and could not be cross-verified against a second outlet, so it should be treated as lower-confidence context rather than a confirmed figure.","heading":"TVL Collapse and Financial Impact","sources":[{"url":"https://www.kucoin.com/news/flash/bitcoin-ethereum-linked-protocols-lose-35-million-in-multiple-attacks-hours-apart","name":"Bitcoin, Ethereum-linked protocols lose $35 million in multiple attacks hours apart","type":"news_article","credibility":2}],"severity":"high"},{"content":"Multiple outlets reported that Verus did not publish a formal, detailed post-mortem for either the May or July 2026 incidents at the time of their reporting. Cryptopolitan stated plainly that 'Verus hasn't published an official post-mortem for Thursday's incident,' referring to the July attack. The Block likewise reported that the team had not issued a public acknowledgment of the May fund recovery as of its reporting. Technical root-cause explanations for both incidents have come primarily from third-party security firms (Blockaid, Merkle Science, PeckShield, GoPlus, CertiK) rather than from Verus itself, which limits independent verification of the project's own account of events.","heading":"Transparency and Communication","sources":[{"url":"https://www.cryptopolitan.com/verus-bridge-second-exploit-flaw-unfixed/","name":"Verus bridge second exploit: flaw unfixed","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth","name":"Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst","type":"news_article","credibility":2}],"severity":"high"},{"content":"For the May 2026 exploit, PeckShield confirmed on-chain that 4,052.4 ETH (about 75% of stolen funds) was returned to Verus in exchange for a 1,350 ETH bounty paid to the attacker, who faced no further pursuit under the settlement's terms. For the July 2026 exploit, no recovery, negotiation, or returned funds have been reported as of the sources reviewed; Cryptopolitan identified the second attacker's wallet address but noted the funds had moved on-chain with no indication of a bounty negotiation or freeze. Proceeds from the July attack were reportedly laundered through Tornado Cash.","heading":"Fund Movement and Recovery Prospects","sources":[{"url":"https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth","name":"Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/verus-bridge-second-exploit-flaw-unfixed/","name":"Verus bridge second exploit: flaw unfixed","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The May 2026 Verus bridge exploit occurred during an unusually active period for DeFi security incidents. A separate THORChain exploit, involving the alleged compromise of an Asgard vault for approximately $10 million (THORChain's own figure was about $10.7 million), was first flagged by security researchers on May 15, 2026, per The Block and Cointelegraph — three days before the Verus incident, not on the same day. A separate incident affecting Echo Protocol's eBTC on Monad, involving an alleged admin-key compromise that let an attacker mint tokens nominally valued at approximately $76 million (realized loss closer to $816,000, per Echo's own estimate), was reported on May 19, 2026, per Cointelegraph and Decrypt — one day after, not the same day as, the Verus exploit. These incidents are unrelated to Verus technically but are frequently cited together in coverage of a turbulent month for cross-chain and DeFi security.","heading":"Context — Co-occurring Third-Party Incidents","sources":[{"url":"https://www.theblock.co/news/defi/2026-05-15-thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit-401462","name":"THORChain pauses trading as security researchers flag suspected $10M multi-chain exploit","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit","name":"THORChain halts trading as ZachXBT flags $10M exploit","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/echo-protocols-ebtc-exploited-for-76m-in-admin-key-compromise","name":"Echo Protocol's eBTC exploited for $76M in admin key compromise","type":"news_article","credibility":2},{"url":"https://decrypt.co/368315/bitcoin-defi-platform-echo-protocol-hit-by-76m-monad-exploit","name":"Bitcoin DeFi platform Echo Protocol hit by $76M Monad exploit","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2026-05-15","event":"THORChain discloses an approximately $10 million (THORChain's own figure: $10.7 million) exploit of an Asgard vault, an incident unrelated to Verus but later miscited by at least one source as co-occurring with the Verus exploit.","source":"The Block","source_url":"https://www.theblock.co/news/defi/2026-05-15-thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit-401462","date_evidence":"THORChain pauses trading as security researchers flag suspected $10M multi-chain exploit — reported 2026-05-15"},{"date":"2026-05-18","event":"The Verus-Ethereum bridge is exploited for approximately $11.58 million via a missing source-amount validation in the checkCCEValues function; stolen assets include roughly 1,625 ETH, 103.6 tBTC, and 147,000 USDC.","source":"Merkle Science","source_url":"https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack","date_evidence":"On the night of 17–18 May 2026"},{"date":"2026-05","event":"Echo Protocol's eBTC deployment on Monad is exploited via an alleged admin-key compromise; minted tokens are valued at roughly $76 million notionally, though Echo's own estimate of realized loss is about $816,000.","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/echo-protocols-ebtc-exploited-for-76m-in-admin-key-compromise","date_evidence":"PeckShield and analytics platform Lookonchain both reported the incident on Tuesday","date_original":"2026-05-19"},{"date":"2026-05","event":"PeckShield confirms on-chain that the Verus bridge attacker returned 4,052.4 ETH (about 75% of stolen funds) in exchange for a 1,350 ETH bounty under a settlement offered by Verus.","source":"The Block","source_url":"https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth","date_original":"2026-05-22"},{"date":"2026-07","event":"Recovered ETH from the May settlement is redeposited into the same, still-unpatched Verus-Ethereum bridge contract as part of a bridge restoration update, according to on-chain records cited by Rekt.","source":"Rekt","source_url":"https://rekt.news/veruscoin-rekt","date_original":"2026-07-08"},{"date":"2026-07","event":"A second, unrelated attacker drains approximately $7.54 million from the Verus-Ethereum bridge using the same contract and vulnerability class as the May exploit; proceeds are laundered through Tornado Cash.","source":"AMBCrypto","source_url":"https://ambcrypto.com/verus-ethereum-bridge-hit-by-second-hack-as-7-54m-vanishes/","date_evidence":"Blockchain security firm Blockaid detected a new attack on the Verus-Ethereum Bridge on the 23rd of July.","date_original":"2026-07-23"}],"sources_used":[{"url":"https://www.theblock.co/post/401571/verus-ethereum-bridge-exploit","name":"Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: Blockaid","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/409489/new-verus-ethereum-bridge-attack","name":"New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: Blockaid","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth","name":"Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst","type":"news_article","credibility":2},{"url":"https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack","name":"Hack Track: The $11.58M Verus Bridge Hack","type":"research","credibility":2},{"url":"https://cryptopotato.com/hacker-steals-over-11m-from-verus-ethereum-bridge/","name":"Hacker Steals Over $11M From Verus-Ethereum Bridge","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/verus-bridge-exploiter-returns-8-5m-keeps-2-8m-as-bounty-reward/","name":"Verus Bridge Exploiter Returns $8.5M, Keeps $2.8M as Bounty Reward","type":"news_article","credibility":2},{"url":"https://coincentral.com/verus-recovers-4052-eth-as-bridge-hacker-keeps-2-8m-bounty/","name":"Verus recovers 4,052 ETH as bridge hacker keeps $2.8M bounty","type":"news_article","credibility":2},{"url":"https://rekt.news/veruscoin-rekt","name":"VerusCoin - Rekt","type":"research","credibility":2},{"url":"https://usethebitcoin.com/news/verus-ethereum-bridge-hack/","name":"Verus Ethereum Bridge Hack Drains $7.54M","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/verus-ethereum-bridge-hit-by-second-hack-as-7-54m-vanishes/","name":"Verus Ethereum Bridge Hit by Second Hack as $7.54M Vanishes","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/verus-bridge-second-exploit-flaw-unfixed/","name":"Verus bridge second exploit: flaw unfixed","type":"news_article","credibility":2},{"url":"https://www.mitrade.com/ae-en/insights/news/live-news/article-3-1929025-20260723","name":"Verus bridge hacked again for $7.54M as an old bug class keeps draining crypto","type":"news_article","credibility":2},{"url":"https://pro.edgex.exchange/en-US/news/article/verus-ethereum-bridge-exploited-again-7-54m","name":"NewsCrypto: Verus Ethereum Bridge Hit Again for $7.54 Million as Prior Bug Class Remains Unfixed","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart","name":"Bitcoin, Ethereum-linked protocols lose $35 million in multiple attacks hours apart","type":"news_article","credibility":1},{"url":"https://www.kucoin.com/news/flash/bitcoin-ethereum-linked-protocols-lose-35-million-in-multiple-attacks-hours-apart","name":"Bitcoin, Ethereum-linked protocols lose $35 million in multiple attacks hours apart (flash)","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/defi/2026-05-15-thorchain-pauses-trading-as-security-researchers-flag-suspected-10m-multi-chain-exploit-401462","name":"THORChain pauses trading as security researchers flag suspected $10M multi-chain exploit","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/thorchain-halts-trading-zachxbt-flags-10m-exploit","name":"THORChain halts trading as ZachXBT flags $10M exploit","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/echo-protocols-ebtc-exploited-for-76m-in-admin-key-compromise","name":"Echo Protocol's eBTC exploited for $76M in admin key compromise","type":"news_article","credibility":2},{"url":"https://decrypt.co/368315/bitcoin-defi-platform-echo-protocol-hit-by-76m-monad-exploit","name":"Bitcoin DeFi platform Echo Protocol hit by $76M Monad exploit","type":"news_article","credibility":2},{"url":"https://www.merklescience.com/blog/hack-track-the-echo-protocol-ebtc-incident","name":"Hack Track: The Echo Protocol (eBTC) Incident","type":"research","credibility":2},{"url":"https://parisblockchainweek.com/speaker-2026/michael-toutonghi","name":"Michael Toutonghi speaker bio, Paris Blockchain Week","type":"other","credibility":2},{"url":"https://redmondmag.com/Articles/2011/12/01/Parallels-Adds-Microsoft-Technical-Fellow.aspx","name":"Parallels Adds Microsoft Technical Fellow to Cloud Division","type":"news_article","credibility":2},{"url":"https://www.coinbase.com/price/veruscoin","name":"VerusCoin price page, Coinbase","type":"other","credibility":2}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-06-14T17:08:39.294475+00:00","updated_at":"2026-10-27T16:53:53.993+00:00"},"source_quality":{"total":23,"tier1":0,"tier2":9,"tier3":0,"unrated":14},"follower_count":null,"content_updated_at":"2026-10-27T16:53:54.408Z","last_fact_checked_at":"2026-06-15T00:11:57.160Z","fact_check_next_allowed_at":null,"update_next_allowed_at":"2026-11-03T16:54:02.066Z"}