Audit log

Every state-changing event for Verus Ethereum Bridge Second Exploit (July 2026): moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-28 17:20:33Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   Ai7LwauR5mrA…S6a5y8H1copysha256 → base58

   verifying row…

   canonical bytes (21148 B) ▸

   {"actor":"system:backfill","investigation_id":"d96ffb36-224d-4516-b961-712c58daad2c","kind":"publish","page_slug":"verus-ethereum-bridge-second-exploit-july-2026","published_at":"2026-07-28T17:20:33.773Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Verus Ethereum Bridge Second Exploit (July 2026)","sections":[{"content":"The Verus-Ethereum Bridge was exploited for the second time in approximately two months on July 23, 2026, at approximately 03:45 UTC. Security firm Blockaid detected the breach and identified the attacker as having abused the bridge's import mechanism — specifically the `submitImports` function — to trigger Ethereum-side payouts without corresponding assets being locked on the Verus blockchain. Approximately $7.54 million in assets were drained in a single primary transaction. The exploit occurred just 15 days after the Verus team redeposited 4,052.4 ETH recovered from the first May 2026 exploit back into the bridge on July 8, 2026. Blockaid confirmed the July attacker used a newly created wallet distinct from the May 2026 exploiter, indicating a different threat actor opportunistically targeting a documented, unresolved vulnerability.","heading":"Incident Overview","severity":"critical","sources":[{"credibility":2,"name":"New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: Blockaid","type":"news_article","url":"https://www.theblock.co/amp/post/409489/new-verus-ethereum-bridge-attack"},{"credibility":2,"name":"Verus Bridge Hit Again as $7.5M Vanishes in Repeat Hack","type":"news_article","url":"https://crypto-economy.com/verus-bridge-hit-again-as-7-5m-vanishes/"},{"credibility":2,"name":"Verus Ethereum Bridge Exploited Again for $7.54M in Repeat Attack","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/verus-ethereum-bridge-exploited-again-for-7-54m-in-repeat-attack/"},{"credibility":1,"name":"Bitcoin, Ethereum-linked protocols lose $35 million in multiple attacks hours apart","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart"}]},{"content":"The exploit targeted a logic flaw in the Verus-Ethereum Bridge's cross-chain import validation path. The bridge contract correctly verified notarization signatures and Merkle proofs submitted with import claims, but critically failed to confirm that the value committed on the Verus source chain matched the payout amount released on the Ethereum side. Security researchers described the flaw as residing in the `checkCCEValues` function — approximately ten missing lines of Solidity validation that permitted attackers to present minimal or zero-value Verus-side commitments while triggering large Ethereum-side payouts. In practical terms, a negligible Verus transaction fee could be used to authorize a multimillion-dollar payout from the Ethereum bridge reserves. This vulnerability class is analogous to structural economic validation gaps seen in prior cross-chain bridge exploits including Wormhole (2022) and Nomad (2022). Blockaid described both the May and July attacks as sharing 'the same bridge contract, same entry path, and same bug class,' indicating the underlying flaw was never meaningfully patched between the two incidents.","heading":"Vulnerability: Missing Value Validation in Bridge Import Logic","severity":"critical","sources":[{"credibility":2,"name":"Hack Track: The $11.58M Verus Bridge Hack — Merkle Science","type":"research","url":"https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack"},{"credibility":2,"name":"Verus bridge hit by second exploit, flaw remains unfixed","type":"news_article","url":"https://www.cryptopolitan.com/verus-bridge-second-exploit-flaw-unfixed/"},{"credibility":2,"name":"AFX Trade and VerusCoin bridges exploited for $31 million in July 2026","type":"news_article","url":"https://en.coin-turk.com/afx-trade-and-veruscoin-bridges-exploited-for-31-million-in-july-2026/"}]},{"content":"The attacker drained seven asset types from the bridge's Ethereum reserves: approximately 1,137 ETH, tokenized bitcoin (tBTC), USDC, USDT, EURC, MKR, and scrvUSD. The total value at time of exploit was approximately $7.54 million. The primary exploit transaction hash has been reported as 0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099. The attacker's initiating wallet was identified as 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c, with stolen proceeds consolidated into a loot wallet reported as 0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54. Following the exploit, the attacker converted the mixed-asset basket into approximately 3,916 ETH via decentralized exchange routes before routing portions through Tornado Cash to obscure the fund trail. No funds had been recovered or frozen as of the time of initial reporting.","heading":"Assets Stolen and On-Chain Details","severity":"critical","sources":[{"credibility":2,"name":"Verus Ethereum Bridge Exploited Again for $7.54M in Repeat Attack","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/verus-ethereum-bridge-exploited-again-for-7-54m-in-repeat-attack/"},{"credibility":2,"name":"Verus Ethereum Bridge Drained Of $7.54M In Second Exploit","type":"news_article","url":"https://cryptoadventure.com/verus-ethereum-bridge-drained-of-7-54m-in-second-exploit/"},{"credibility":3,"name":"Wu Blockchain on X — Verus second exploit summary","type":"social_media","url":"https://x.com/WuBlockchain/status/2080186805060771975"}]},{"content":"The July 23 incident is inseparable from the May 18, 2026 first exploit, in which an attacker drained $11.58 million in ETH, tBTC, and USDC from the same bridge contract via the same missing value-check vulnerability. In the weeks following the May exploit, the Verus team negotiated a settlement with the May attacker, who agreed to return 4,052.4 ETH (approximately $8.5 million) while retaining 1,350 ETH (approximately $2.8 million) as an acknowledged bounty. The returned funds were redeposited into the bridge on July 8, 2026, effectively reloading a bridge contract that multiple security researchers and the Blockaid firm had identified as carrying an unresolved structural vulnerability. The decision to reopen and redeposit into the unfixed contract — rather than deploying a patched replacement — has been identified by analysts as a critical governance failure. Fifteen days after redeposit, the bridge was fully drained again. Whether the May patch was incomplete, reverted, or never applied to the production contract was not confirmed in official communications at time of reporting.","heading":"Connection to the First Exploit (May 18, 2026) and the Redeposit Decision","severity":"critical","sources":[{"credibility":2,"name":"Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst","type":"news_article","url":"https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth"},{"credibility":2,"name":"Verus Exploit Attacker Returns $8.5M in ETH After Settlement Deal","type":"news_article","url":"https://www.cryptowisser.com/news/verus-exploit-attacker-returns-8-5m-usd-in-eth-after-settlement"},{"credibility":2,"name":"Verus Bridge Hack Resolved: 4,052 ETH Recovered Through $2.8M Bounty Deal","type":"news_article","url":"https://blockonomi.com/verus-bridge-hack-resolved-4052-eth-recovered-through-2-8m-bounty-deal"},{"credibility":2,"name":"Verus Bridge Suffers Second Exploit in 66 Days as Flaw Pushes Total Losses to $19.1M","type":"news_article","url":"https://news.bitcoin.com/verus-bridge-suffers-second-exploit-in-66-days-as-flaw-pushes-total-losses-to-19-1m/"}]},{"content":"The Verus bridge second exploit occurred on the same day — July 22-23, 2026 — as a separate exploit of the AFX Trade cross-chain bridge, which suffered losses of approximately $24 million. Combined, the two incidents resulted in approximately $31.5 million in losses within a single 24-hour period, and contributed to a reported $35 million in total DeFi losses across multiple protocols within a roughly six-hour window. CoinDesk reported the combined incident as part of a broader pattern of cross-chain bridge vulnerabilities persisting into 2026 despite years of documented incidents in the sector. The two Verus exploits alone, totaling approximately $19.1 million, represented the largest two-incident cumulative loss on a single bridge contract in 2026 as of the date of the July attack.","heading":"Broader Context: Co-Occurrence with AFX Trade Exploit","severity":"high","sources":[{"credibility":2,"name":"Two Cross-Chain Bridges Hacked in One Day — $31.5M Lost","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud/bridge-hacks-july/"},{"credibility":1,"name":"Bitcoin, Ethereum-linked protocols lose $35 million in multiple attacks hours apart","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart"},{"credibility":2,"name":"Crypto Loses Over $47M in a Week as AFX Trade, Wanchain, Verus Get Hacked","type":"news_article","url":"https://www.cryptotimes.io/2026/07/26/crypto-loses-over-47m-in-a-week-as-afx-trade-wanchain-verus-get-hacked/"}]},{"content":"VerusCoin had not issued a public post-mortem or official statement specifically addressing the July 23, 2026 exploit as of the time of initial reporting. No timeline for restoring bridge operations was announced. Security researchers and news outlets urged users to avoid the bridge entirely. Blockaid and other security firms requested exchanges and stablecoin issuers — including relevant parties for USDC (Circle) and USDT (Tether) — to monitor attacker wallet addresses for downstream movement to facilitate potential freezes. The protocol's total value locked was reported to have declined sharply following the two exploits, falling from approximately $100 million at the start of 2025 to roughly $9 million by the time of the second exploit. The absence of any deployed patch between the May and July incidents, combined with the redeposit of recovered funds into an unpatched contract, represent the central governance concerns raised by analysts.","heading":"Protocol Response and User Guidance","severity":"high","sources":[{"credibility":2,"name":"Verus bridge hit by second exploit, flaw remains unfixed","type":"news_article","url":"https://www.cryptopolitan.com/verus-bridge-second-exploit-flaw-unfixed/"},{"credibility":2,"name":"Verus Ethereum Bridge Suffers Second $7.5 Million Exploit","type":"news_article","url":"https://coinpedia.org/crypto-live-news/verus-ethereum-bridge-suffers-second-7-5-million-exploit/"},{"credibility":2,"name":"Verus-Ethereum Bridge hit by second hack as $7.54M vanishes","type":"news_article","url":"https://ambcrypto.com/verus-ethereum-bridge-hit-by-second-hack-as-7-54m-vanishes/"}]},{"content":"Following the exploit, the July 2026 attacker consolidated the stolen multi-asset basket — including ETH, tBTC, and multiple stablecoins and tokens — into approximately 3,916 ETH through decentralized exchange swaps. The attacker then began routing portions of the consolidated ETH through Tornado Cash, an Ethereum-based coin mixer that has been sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) since August 2022. Use of Tornado Cash to launder exploit proceeds is consistent with prior major DeFi exploit events and significantly reduces the probability of on-chain fund tracing or recovery. No exchange freezes or fund recoveries from the July exploit had been reported as of initial publication.","heading":"Fund Laundering via Tornado Cash","severity":"high","sources":[{"credibility":2,"name":"AFX Trade and VerusCoin bridges exploited for $31 million in July 2026","type":"news_article","url":"https://en.coin-turk.com/afx-trade-and-veruscoin-bridges-exploited-for-31-million-in-july-2026/"},{"credibility":2,"name":"Verus Ethereum Bridge Exploited Again for $7.54M in Repeat Attack","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/verus-ethereum-bridge-exploited-again-for-7-54m-in-repeat-attack/"}]}],"sources_used":[{"credibility":1,"name":"Bitcoin, Ethereum-linked protocols lose $35 million in multiple attacks hours apart","type":"news_article","url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart"},{"credibility":2,"name":"New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: Blockaid","type":"news_article","url":"https://www.theblock.co/amp/post/409489/new-verus-ethereum-bridge-attack"},{"credibility":2,"name":"Verus Bridge Suffers Second Exploit in 66 Days as Flaw Pushes Total Losses to $19.1M","type":"news_article","url":"https://news.bitcoin.com/verus-bridge-suffers-second-exploit-in-66-days-as-flaw-pushes-total-losses-to-19-1m/"},{"credibility":2,"name":"Verus Bridge Hit Again as $7.5M Vanishes in Repeat Hack","type":"news_article","url":"https://crypto-economy.com/verus-bridge-hit-again-as-7-5m-vanishes/"},{"credibility":2,"name":"Verus Ethereum Bridge Exploit Drains $7.54M in Latest Attack","type":"news_article","url":"https://en.cryptonomist.ch/2026/07/23/verus-ethereum-bridge-exploit-2/"},{"credibility":2,"name":"Verus Ethereum Bridge Drained Of $7.54M In Second Exploit","type":"news_article","url":"https://cryptoadventure.com/verus-ethereum-bridge-drained-of-7-54m-in-second-exploit/"},{"credibility":2,"name":"Verus Ethereum Bridge Suffers Second $7.5 Million Exploit","type":"news_article","url":"https://coinpedia.org/crypto-live-news/verus-ethereum-bridge-suffers-second-7-5-million-exploit/"},{"credibility":2,"name":"Verus bridge hit by second exploit, flaw remains unfixed","type":"news_article","url":"https://www.cryptopolitan.com/verus-bridge-second-exploit-flaw-unfixed/"},{"credibility":2,"name":"Verus Ethereum Bridge Exploited Again for $7.54M in Repeat Attack","type":"news_article","url":"https://www.cryptotimes.io/2026/07/23/verus-ethereum-bridge-exploited-again-for-7-54m-in-repeat-attack/"},{"credibility":2,"name":"Verus bridge exploiter returns 4,052 ETH, retains $2.8 million bounty: onchain analyst","type":"news_article","url":"https://www.theblock.co/post/402319/verus-bridge-exploiter-returns-4052-eth"},{"credibility":2,"name":"Verus Bridge Hack Resolved: 4,052 ETH Recovered Through $2.8M Bounty Deal","type":"news_article","url":"https://blockonomi.com/verus-bridge-hack-resolved-4052-eth-recovered-through-2-8m-bounty-deal"},{"credibility":2,"name":"Verus Exploit Attacker Returns $8.5M in ETH After Settlement Deal","type":"news_article","url":"https://www.cryptowisser.com/news/verus-exploit-attacker-returns-8-5m-usd-in-eth-after-settlement"},{"credibility":2,"name":"Verus Bridge Exploited: $11.58M Drained, Attack Still Live","type":"news_article","url":"https://www.ccn.com/news/crypto/verus-bridge-exploited-12m-drained-attack-still-live/"},{"credibility":2,"name":"$11.58M Drained in Ongoing Exploit on Verus-Ethereum Bridge","type":"news_article","url":"https://thedefiant.io/news/hacks/verus-ethereum-bridge-exploit-11-5-million-ri18bt"},{"credibility":2,"name":"Hack Track: The $11.58M Verus Bridge Hack — Merkle Science","type":"research","url":"https://www.merklescience.com/blog/hack-track-the-11-58m-verus-bridge-hack"},{"credibility":2,"name":"Explained: The Verus-Ethereum Bridge Hack (May 2026) — Halborn","type":"research","url":"https://www.halborn.com/blog/post/explained-the-verus-ethereum-bridge-hack-may-2026"},{"credibility":2,"name":"AFX Trade and VerusCoin bridges exploited for $31 million in July 2026","type":"news_article","url":"https://en.coin-turk.com/afx-trade-and-veruscoin-bridges-exploited-for-31-million-in-july-2026/"},{"credibility":2,"name":"Two Cross-Chain Bridges Hacked in One Day — $31.5M Lost","type":"news_article","url":"https://bitcoinfoundation.org/news/crimes-and-fraud/bridge-hacks-july/"},{"credibility":2,"name":"Crypto Loses Over $47M in a Week as AFX Trade, Wanchain, Verus Get Hacked","type":"news_article","url":"https://www.cryptotimes.io/2026/07/26/crypto-loses-over-47m-in-a-week-as-afx-trade-wanchain-verus-get-hacked/"},{"credibility":2,"name":"Verus bridge attacker sends back $8.5M, keeps bounty","type":"news_article","url":"https://crypto.news/verus-bridge-attacker-sends-back-8-5m-keeps-bounty/"},{"credibility":2,"name":"Verus Ethereum Bridge hacked again for $7.54M after May exploit","type":"news_article","url":"https://crypto.news/verus-ethereum-bridge-hacked-again-for-7-54m-after-may-exploit/"},{"credibility":3,"name":"Wu Blockchain on X — Verus second exploit summary","type":"social_media","url":"https://x.com/WuBlockchain/status/2080186805060771975"},{"credibility":2,"name":"Verus-Ethereum bridge hit by second hack as $7.54M vanishes — AMBCrypto","type":"news_article","url":"https://ambcrypto.com/verus-ethereum-bridge-hit-by-second-hack-as-7-54m-vanishes/"},{"credibility":2,"name":"Verus Secures Return of 4,052 ETH Following Bridge Attack Bounty Deal — MoneyCheck","type":"news_article","url":"https://moneycheck.com/verus-secures-return-of-4052-eth-following-bridge-attack-bounty-deal"}],"summary":"On July 23, 2026, the Verus-Ethereum Bridge suffered a second major security exploit in 66 days, with an attacker draining approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. The attack exploited the same contract, entry path, and vulnerability class as a May 18, 2026 incident that had drained $11.58 million — raising critical concerns that the underlying flaw was never properly remediated before recovered funds were redeposited into the bridge on July 8, 2026. Combined losses from both exploits total approximately $19.1 million, with the July attacker subsequently laundering stolen assets through Tornado Cash.","timeline":[{"date":"2026-05-17","event":"First Verus-Ethereum Bridge exploit begins. Blockaid detects suspicious activity at approximately 00:54 GMT. Attacker drains $11.58 million in ETH, tBTC, and USDC by exploiting missing source-amount validation in the bridge's checkCCEValues function.","source":"The Defiant / Merkle Science","source_url":"https://thedefiant.io/news/hacks/verus-ethereum-bridge-exploit-11-5-million-ri18bt"},{"date":"2026-05-18","event":"First exploit attack confirmed complete. Attacker consolidates approximately 5,402 ETH. CoinDesk reports the incident as part of a broader 2026 DeFi exploit wave exceeding $750 million.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/05/18/yet-another-crypto-bridge-falls-victim-to-an-usd11-million-hack"},{"date":"2026-06-01","event":"Verus team reaches settlement with May attacker. Attacker agrees to return 4,052.4 ETH (approximately $8.5 million) and retain 1,350 ETH (approximately $2.8 million) as an acknowledged bounty.","source":"The Block / Blockonomi","source_url":"https://blockonomi.com/verus-bridge-hack-resolved-4052-eth-recovered-through-2-8m-bounty-deal"},{"date":"2026-07-08","event":"Verus team redeposits recovered ETH into the same bridge contract. The bridge is reopened for use. Security analysts later note the underlying vulnerability was not patched prior to this redeposit.","source":"CoinDesk / crypto.news","source_url":"https://www.coindesk.com/tech/2026/07/23/bitcoin-ethereum-linked-protocols-lose-usd35-million-in-multiple-attacks-hours-apart"},{"date":"2026-07-23","event":"Second exploit occurs at approximately 03:45 UTC. A different attacker — using wallet 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c — drains approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD via the same submitImports vulnerability. Blockaid detects and publicly discloses the incident.","source":"The Block / CoinDesk / Blockaid","source_url":"https://www.theblock.co/amp/post/409489/new-verus-ethereum-bridge-attack"},{"date":"2026-07-23","event":"Attacker converts stolen assets into approximately 3,916 ETH via DEX swaps and begins routing portions through Tornado Cash to obscure fund trail. Combined Verus bridge losses reach approximately $19.1 million across both exploits.","source":"Cryptopolitan / CryptoTimes","source_url":"https://www.cryptopolitan.com/verus-bridge-second-exploit-flaw-unfixed/"},{"date":"2026-07-23","event":"AFX Trade bridge exploited for approximately $24 million in a separate incident on the same day, contributing to a total of approximately $31.5 million in cross-chain bridge losses within 24 hours.","source":"Bitcoin Foundation News / CoinDesk","source_url":"https://bitcoinfoundation.org/news/crimes-and-fraud/bridge-hacks-july/"},{"date":"2026-07-26","event":"Reporting confirms VerusCoin had issued no official post-mortem or public statement regarding the July exploit. No patch deployment or bridge reopening timeline is announced. Total weekly crypto losses attributed to bridge attacks reach over $47 million.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/07/26/crypto-loses-over-47m-in-a-week-as-afx-trade-wanchain-verus-get-hacked/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 7e1a5c89-f450-40a7-9f87-87483904351acopy