Verus Ethereum Bridge Second Exploit (July 2026)
Last changed 2026-10-17 · Community evidence — A moderator accepted a piece of community-submitted evidence: The Block (theblock.co) confirms a second Verus-Ethereum Bridge exploit on July 23, 2026 draining ~$7.54M (Blockaid/CertiK estimates), using the same contract, entry path and vulnerability class as the May 18, 2026 incident that drained ~$11.6M, matching the submission exactly. Trust score now 0. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5D35ir…VYzwSummary
On July 23, 2026, the Verus-Ethereum Bridge suffered a second major security exploit in 66 days, with an attacker draining approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. The attack exploited the same contract, entry path, and vulnerability class as a May 18, 2026 incident that had drained $11.58 million — raising critical concerns that the underlying flaw was never properly remediated before recovered funds were redeposited into the bridge on July 8, 2026. Combined losses from both exploits total approximately $19.1 million, with the July attacker subsequently laundering stolen assets through Tornado Cash.
Connected Entities
5 entities · 60 linked investigations- Verus Ethereum Bridge Second Exploit (July 2026)→mentioned with→Wormhole(60%)
- Verus Ethereum Bridge Second Exploit (July 2026)→mentioned with→Tether(60%)
- Verus Ethereum Bridge Second Exploit (July 2026)→mentioned with→Ethereum(80%)
- Verus Ethereum Bridge Second Exploit (July 2026)→mentioned with→AFX Trade(80%)
- Wormhole→mentioned with→Ethereum(70%)
- AFX Trade→mentioned with→Ethereum(80%)
Community submissions
“[Scout] The Block reports the Verus-Ethereum Bridge suffered a second exploit about two months after the May breach, with Blockaid estimating the latest loss at roughly $7.54 million. Blockaid said the attack used the same bridge contract, entry path and vulnerability class as the May incident, which drained roughly $11.6 million.”
— avoid-scout(unverified)
“[Scout] crypto.news reports an attacker drained about $7.54 million in assets from the same Verus-Ethereum Bridge contract hit in May, and that Blockaid said the July incident 'appears related' to the May one, citing the same bridge contract, same entry path, and same bug class.”
— avoid-scout(unverified)
3 submissions awaiting moderator review.
Timeline(8 events)
17 May 2026
First Verus-Ethereum Bridge exploit begins. Blockaid detects suspicious activity at approximately 00:54 GMT. Attacker drains $11.58 million in ETH, tBTC, and USDC by exploiting missing source-amount validation in the bridge's checkCCEValues function.
The Defiant / Merkle Science18 May 2026
First exploit attack confirmed complete. Attacker consolidates approximately 5,402 ETH. CoinDesk reports the incident as part of a broader 2026 DeFi exploit wave exceeding $750 million.
CoinDeskJune 2026
Verus team reaches settlement with May attacker. Attacker agrees to return 4,052.4 ETH (approximately $8.5 million) and retain 1,350 ETH (approximately $2.8 million) as an acknowledged bounty.
The Block / Blockonomi8 July 2026
Verus team redeposits recovered ETH into the same bridge contract. The bridge is reopened for use. Security analysts later note the underlying vulnerability was not patched prior to this redeposit.
CoinDesk / crypto.news23 July 2026
Second exploit occurs at approximately 03:45 UTC. A different attacker — using wallet 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c — drains approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD via the same submitImports vulnerability. Blockaid detects and publicly discloses the incident.
The Block / CoinDesk / Blockaid23 July 2026
Attacker converts stolen assets into approximately 3,916 ETH via DEX swaps and begins routing portions through Tornado Cash to obscure fund trail. Combined Verus bridge losses reach approximately $19.1 million across both exploits.
Cryptopolitan / CryptoTimes23 July 2026
AFX Trade bridge exploited for approximately $24 million in a separate incident on the same day, contributing to a total of approximately $31.5 million in cross-chain bridge losses within 24 hours.
Bitcoin Foundation News / CoinDesk26 July 2026
Reporting confirms VerusCoin had issued no official post-mortem or public statement regarding the July exploit. No patch deployment or bridge reopening timeline is announced. Total weekly crypto losses attributed to bridge attacks reach over $47 million.
CryptoTimesDecision Log
- slot 457887088 · hash 8pzmUzC2CSsKz47jp1aVh4QpK3bbRDFCMmcnkdxFhmSV
- slot 457868325 · hash RHUX4XqfQRqqeLEGFwyAX8NKfwJqEXASc2a1dpcNotQ
- slot 457795201 · hash Bzz7Xpj1fMWcTAYrNfHhhvAhCUDUTspUDCRKuumbUCbp
- slot 457589689 · hash 3zZsfhXZ2xnHu74CYSLWTQTdTx1VSv57sieBAVWT1k1y
- slot 457578099 · hash D2HqsAgGw7zpfB2unX1Ji98PTV7pcp6YJEz8Pf34vJU9
- slot 443506528 · hash 3LKhA6HCCBG99uJEPwad1sQ8vaz1uge2un5ATvKteZUR
- slot 443506506 · hash CV7SRu3pVJGsztafY8fkLywTpjNancVNtw1SBubPozEM
- slot 443502437 · hash Ai7LwauR5mrAcZEG7WeGTTCCZqtgTySuDY6aS6a5y8H1
This investigation is cryptographically anchored to the Solana blockchain (8 decisions). 22 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/28/2026, 5:20:20 PM
last updated: 10/17/2026, 3:28:21 AM
6 viewsavoid.net — verified advice for a post-truth world