← Verus Ethereum Bridge Second Exploit (July 2026)reviewed 2026-10-16 · 19 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Verus Ethereum Bridge Second Exploit (July 2026) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
2 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #11[disputed][awaiting moderator]in the timeline
“2026-06”
reviewerThe Verus team negotiated a settlement with the May attacker, who agreed to return 4,052.4 ETH while retaining 1,350 ETH, with the settlement reached in June 2026.The page's own cited sources for this event are dated May 22, 2026 and describe the settlement/return as already completed on that date, not in June as the timeline field states. The 1,350/4,052.4 ETH figures themselves are correct; only the date field is wrong.Proposed correction (not yet applied)2026-05-22 - #15[disputed][awaiting moderator]in section: Protocol Response and User Guidance
“The protocol's total value locked was reported to have declined sharply following the two exploits, falling from approximately $100 million at the start of 2025 to roughly $9 million by the time of the second exploit.”
reviewerVerusCoin had not issued a public post-mortem or official statement specifically addressing the July 23, 2026 exploit as of the time of initial reporting; TVL declined from approximately $100 million at the start of 2025 to roughly $9 million by the time of the second exploit.The page's cited source for this sentence (Cryptopolitan) contains no TVL data at all, and the only independent source found with comparable before/after TVL figures gives $90M→under $5M rather than $100M→$9M. Treating as disputed given the mismatch with the only sourced figures found; could not find the $100M/$9M figures anywhere.Proposed correction (not yet applied)The protocol's total value locked was reported to have declined sharply following the two exploits, falling from approximately $90 million at the start of 2025 to under $5 million by the time of the second exploit.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #12[unverifiable][awaiting moderator]in section: Connection to the First Exploit (May 18, 2026) and the Redeposit Decision
“The decision to reopen and redeposit into the unfixed contract — rather than deploying a patched replacement — has been identified by analysts as a critical governance failure.”
reviewerThe decision to reopen and redeposit into the unfixed contract has been identified by analysts as a critical governance failure.The underlying facts (redeposit into unpatched contract, 15 days before second drain) are confirmed elsewhere in this review; the specific framing as a named analyst consensus of 'critical governance failure' could not be independently verified to any specific analyst. - #14[unverifiable][awaiting moderator]in section: Broader Context: Co-Occurrence with AFX Trade Exploit
“The two Verus exploits alone, totaling approximately $19.1 million, represented the largest two-incident cumulative loss on a single bridge contract in 2026 as of the date of the July attack.”
reviewerThe two Verus exploits alone, totaling approximately $19.1 million, represented the largest two-incident cumulative loss on a single bridge contract in 2026 as of the date of the July attack.This is an editorial superlative with no citation support in any of the page's own sources; none of the fetched articles make this specific 'largest two-incident, same-contract' ranking claim. Flagged as unverifiable rather than disputed because the narrow framing (cumulative across two incidents on the same contract) was not directly addressed by any source, confirming or denying. - #16[unverifiable][awaiting moderator]in section: Protocol Response and User Guidance
“Blockaid and other security firms requested exchanges and stablecoin issuers — including relevant parties for USDC (Circle) and USDT (Tether) — to monitor attacker wallet addresses for downstream movement to facilitate potential freezes.”
reviewerBlockaid and other security firms requested exchanges and stablecoin issuers (Circle, Tether) to monitor attacker wallet addresses for downstream movement.Could not confirm this specific claim in the cited Cryptopolitan source; the coinpedia.org source is dead and could not be checked directly. Not necessarily false — such requests are standard practice after bridge exploits — but unverified from the cited sources checked.
stale
1 claimThe claim was accurate when written but events since have overtaken it.
- #17[stale][awaiting moderator]in section: Fund Laundering via Tornado Cash
“The attacker then began routing portions of the consolidated ETH through Tornado Cash, an Ethereum-based coin mixer that has been sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) since August 2022.”
reviewerTornado Cash is an Ethereum-based coin mixer that has been sanctioned by OFAC since August 2022.This claim was true from August 2022 but is stale as of the events described (July 2026) and as of today: OFAC delisted Tornado Cash in March 2025. The 'has been sanctioned ... since August 2022' framing implies an ongoing designation that no longer holds, which also undercuts the sentence's implicit point about reduced traceability via official sanctions status.Proposed correction (not yet applied)The attacker then began routing portions of the consolidated ETH through Tornado Cash, an Ethereum-based coin mixer that was sanctioned by the U.S. Treasury's Office of Foreign Assets Control (OFAC) from August 2022 until the designation was removed in March 2025.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #8[partially supported][awaiting moderator]in section: Vulnerability: Missing Value Validation in Bridge Import Logic
“Blockaid described both the May and July attacks as sharing 'the same bridge contract, same entry path, and same bug class,' indicating the underlying flaw was never meaningfully patched between the two incidents.”
reviewerBlockaid described both the May and July attacks as sharing 'the same bridge contract, same entry path, and same bug class.'The substance is accurate and independently verified via rekt.news, but the page presents it as a direct quotation attributed to its own cited sources (Merkle Science, Cryptopolitan, Coin-Turk), none of which carries this exact wording in the fetched text. Downgraded to partially_supported for sourcing/attribution precision rather than factual accuracy.
confirmed
12 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in the summary
“On July 23, 2026, the Verus-Ethereum Bridge suffered a second major security exploit in 66 days, with an attacker draining approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD.”
reviewerOn July 23, 2026, the Verus-Ethereum Bridge suffered a second major exploit, with an attacker draining approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD.66-day gap arithmetic (May 18 to July 23) checks out, and the $7.54M figure and asset list match Blockaid/CertiK reporting. - #2[confirmed][no action needed]in the summary
“The attack exploited the same contract, entry path, and vulnerability class as a May 18, 2026 incident that had drained $11.58 million”
reviewerThe attack exploited the same contract, entry path, and vulnerability class as the May 18, 2026 incident that had drained $11.58 million.Confirmed; $11.58M May figure also matches Merkle Science and The Block reporting. - #3[confirmed][no action needed]in the summary
“raising critical concerns that the underlying flaw was never properly remediated before recovered funds were redeposited into the bridge on July 8, 2026”
reviewerRecovered funds from the May exploit were redeposited into the bridge on July 8, 2026.Confirmed; 15-day gap to July 23 also checks out. - #4[confirmed][no action needed]in the summary
“Combined losses from both exploits total approximately $19.1 million, with the July attacker subsequently laundering stolen assets through Tornado Cash.”
reviewerCombined losses from both Verus exploits total approximately $19.1 million.Confirmed and arithmetically consistent. - #5[confirmed][no action needed]in section: Incident Overview
“Blockaid confirmed the July attacker used a newly created wallet distinct from the May 2026 exploiter, indicating a different threat actor opportunistically targeting a documented, unresolved vulnerability.”
reviewerBlockaid confirmed the July attacker used a newly created wallet distinct from the May 2026 exploiter.Directly supported. - #6[confirmed][no action needed]in section: Vulnerability: Missing Value Validation in Bridge Import Logic
“Security researchers described the flaw as residing in the `checkCCEValues` function — approximately ten missing lines of Solidity validation that permitted attackers to present minimal or zero-value Verus-side commitments while triggering large Ethereum-side payouts.”
reviewerSecurity researchers described the flaw as residing in the checkCCEValues function — approximately ten missing lines of Solidity validation.Confirmed via cited source. - #7[confirmed][no action needed]in section: Vulnerability: Missing Value Validation in Bridge Import Logic
“This vulnerability class is analogous to structural economic validation gaps seen in prior cross-chain bridge exploits including Wormhole (2022) and Nomad (2022).”
reviewerThis vulnerability class is analogous to structural economic validation gaps seen in prior cross-chain bridge exploits including Wormhole (2022) and Nomad (2022).Confirmed by independent reporting, though not one of the page's own cited sources explicitly makes the Wormhole/Nomad comparison in the fetched text. - #9[confirmed][no action needed]in section: Assets Stolen and On-Chain Details
“The primary exploit transaction hash has been reported as 0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099. The attacker's initiating wallet was identified as 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c, with stolen proceeds consolidated into a loot wallet reported as 0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54.”
reviewerThe attacker drained seven asset types including approximately 1,137 ETH, with total value approximately $7.54 million; the exploit transaction hash was 0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099; the attacker wallet was 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c and the loot wallet 0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54.Fully corroborated by two independent sources with matching on-chain identifiers. - #10[confirmed][no action needed]in section: Assets Stolen and On-Chain Details
“Following the exploit, the attacker converted the mixed-asset basket into approximately 3,916 ETH via decentralized exchange routes before routing portions through Tornado Cash to obscure the fund trail. No funds had been recovered or frozen as of the time of initial reporting.”
reviewerThe attacker converted the stolen basket into approximately 3,916 ETH via DEX routes before routing portions through Tornado Cash; no funds had been recovered or frozen as of initial reporting.Confirmed; a further search for later developments (through Oct 2026) found no reports of recovery or freezes superseding this. - #13[confirmed][no action needed]in section: Broader Context: Co-Occurrence with AFX Trade Exploit
“The Verus bridge second exploit occurred on the same day — July 22-23, 2026 — as a separate exploit of the AFX Trade cross-chain bridge, which suffered losses of approximately $24 million. Combined, the two incidents resulted in approximately $31.5 million in losses within a single 24-hour period, and contributed to a reported $35 million in total DeFi losses across multiple protocols within a roughly six-hour window.”
reviewerThe Verus bridge second exploit occurred on the same day as a separate AFX Trade bridge exploit of approximately $24 million; combined losses were approximately $31.5 million within 24 hours, contributing to $35 million in total DeFi losses within a roughly six-hour window.Confirmed, though the $24.15M AFX figure is rounded down slightly to 'approximately $24 million' — acceptable rounding. - #18[confirmed][no action needed]in the timeline
“Reporting confirms VerusCoin had issued no official post-mortem or public statement regarding the July exploit. No patch deployment or bridge reopening timeline is announced. Total weekly crypto losses attributed to bridge attacks reach over $47 million.”
reviewerReporting confirms VerusCoin had issued no official post-mortem; total weekly crypto losses attributed to bridge attacks reached over $47 million.Directly confirmed by cited source. - #19[confirmed][no action needed]in the timeline
“First Verus-Ethereum Bridge exploit begins. Blockaid detects suspicious activity at approximately 00:54 GMT. Attacker drains $11.58 million in ETH, tBTC, and USDC by exploiting missing source-amount validation in the bridge's checkCCEValues function.”
reviewerThe first Verus-Ethereum bridge exploit occurred on May 18, 2026, and the attacker drained $11.58 million in ETH, tBTC, and USDC by exploiting missing source-amount validation in checkCCEValues, detected by Blockaid around 00:54 GMT.Core facts confirmed; minor date ambiguity (May 17 vs 18) in underlying reporting is reasonably reconciled by the page's own two-part timeline.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.