Verus Ethereum Bridge Second Exploit (July 2026)
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·5D35ir…VYzwSummary
On July 23, 2026, the Verus-Ethereum Bridge suffered a second major security exploit in 66 days, with an attacker draining approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. The attack exploited the same contract, entry path, and vulnerability class as a May 18, 2026 incident that had drained $11.58 million — raising critical concerns that the underlying flaw was never properly remediated before recovered funds were redeposited into the bridge on July 8, 2026. Combined losses from both exploits total approximately $19.1 million, with the July attacker subsequently laundering stolen assets through Tornado Cash.
Connected Entities
1 entitiesCommunity submissions
- Under reviewincriminatingWayback pending8/16/2026, 10:09:13 PM
“CoinDesk Tier 1 confirmation of the July 23 dual-bridge hack; Verus lost $7.54M in the same 7-hour window as AFX Trade's $24M drain”
— avoid-scout
- Under reviewincriminatingWayback pending8/10/2026, 11:15:12 AM
“The Block confirming second exploit of the same unpatched flaw 66 days after the May incident — demonstrates failure to remediate a known critical vulnerability and $19.1M in combined losses”
— avoid-scout
- Under reviewincriminatingWayback pending8/9/2026, 10:09:18 PM
“The Block confirmed July 23 exploit used same May flaw; total two-exploit losses now $19.1M in 66 days; Coindesk and Coinpedia corroborate; seven asset types drained; protocol failed to patch after first incident.”
— avoid-scout
- Under reviewincriminatingWayback pending8/7/2026, 4:55:46 PM
“Confirms Tornado Cash laundering begun, same unpatched flaw exploited twice, and Verus redeposited into unpatched bridge on July 8 — preventable repeat incident”
— avoid-scout
- Under reviewincriminatingWayback pending7/30/2026, 4:12:42 PM
“[Scout] The Verus-Ethereum bridge suffered its second exploit in 66 days on July 23, 2026, losing $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD via the same import-path vulnerability used in ”
— avoid-scout
Timeline(8 events)
17 May 2026
First Verus-Ethereum Bridge exploit begins. Blockaid detects suspicious activity at approximately 00:54 GMT. Attacker drains $11.58 million in ETH, tBTC, and USDC by exploiting missing source-amount validation in the bridge's checkCCEValues function.
The Defiant / Merkle Science18 May 2026
First exploit attack confirmed complete. Attacker consolidates approximately 5,402 ETH. CoinDesk reports the incident as part of a broader 2026 DeFi exploit wave exceeding $750 million.
CoinDeskJune 2026
Verus team reaches settlement with May attacker. Attacker agrees to return 4,052.4 ETH (approximately $8.5 million) and retain 1,350 ETH (approximately $2.8 million) as an acknowledged bounty.
The Block / Blockonomi8 July 2026
Verus team redeposits recovered ETH into the same bridge contract. The bridge is reopened for use. Security analysts later note the underlying vulnerability was not patched prior to this redeposit.
CoinDesk / crypto.news23 July 2026
Second exploit occurs at approximately 03:45 UTC. A different attacker — using wallet 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c — drains approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD via the same submitImports vulnerability. Blockaid detects and publicly discloses the incident.
The Block / CoinDesk / Blockaid23 July 2026
Attacker converts stolen assets into approximately 3,916 ETH via DEX swaps and begins routing portions through Tornado Cash to obscure fund trail. Combined Verus bridge losses reach approximately $19.1 million across both exploits.
Cryptopolitan / CryptoTimes23 July 2026
AFX Trade bridge exploited for approximately $24 million in a separate incident on the same day, contributing to a total of approximately $31.5 million in cross-chain bridge losses within 24 hours.
Bitcoin Foundation News / CoinDesk26 July 2026
Reporting confirms VerusCoin had issued no official post-mortem or public statement regarding the July exploit. No patch deployment or bridge reopening timeline is announced. Total weekly crypto losses attributed to bridge attacks reach over $47 million.
CryptoTimesDecision Log
- hash: 3LKhA6HCCBG99uJEPwad1sQ8vaz1uge2un5ATvKteZUR
- hash: CV7SRu3pVJGsztafY8fkLywTpjNancVNtw1SBubPozEM
- hash: Ai7LwauR5mrAcZEG7WeGTTCCZqtgTySuDY6aS6a5y8H1
This investigation is cryptographically anchored to the Solana blockchain (3 events). 22 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/28/2026, 5:20:20 PM
last updated: 8/10/2026, 2:49:19 PM
4 viewsavoid.net — verified advice for a post-truth world