Verus Protocol (VRSC)
Last changed 2026-10-16 · Community evidence — A moderator accepted a piece of community-submitted evidence: crypto.news confirms the July 23, 2026 ~$7.54M exploit of the Verus-Ethereum Bridge from the same contract hit in May, with Blockaid saying it appears related (same contract, entry path, bug class) and no confirmed technical cause yet released — matching the note. Trust score now 23. Version history →
Why this score
| Every page starts at | 65 |
| Concerns that are not fraud | -26 |
| Incidents it suffered (e.g. hacks) | -20 |
| Problems around it, caused by others | -1.8 |
| Long-running | +10 |
| Recent unresolved incident | -15.5 |
| Sum | 12 |
- The penalty for incidents it suffered is capped at 20 points.
Score: 23/100 (kept between 0 and 100)
How scoring works →Summary
Verus Protocol (VRSC) is an open-source, fair-launched, privacy-focused blockchain launched in May 2018 by Michael J. Toutonghi, offering hybrid proof-of-work/proof-of-stake consensus, VerusID and Public Blockchains as a Service (PBaaS). Its Ethereum cross-chain bridge was exploited twice in 2026, for about $11.58M on May 18 and about $7.54M on July 23, through the same missing source-amount validation in the bridge's import path. The team recovered most of the first loss through a negotiated bounty but reopened the bridge on about July 8 without a confirmed patch or independent audit, which enabled the repeat attack and raises serious concerns about security governance.
Connected Entities
5 entities · 60 linked investigations- Verus Protocol (VRSC)→mentioned with→Wormhole(65%)
- Verus Protocol (VRSC)→mentioned with→Ethereum(80%)
- Verus Protocol→mentioned with→Ethereum(80%)
- Verus Protocol→mentioned with→Wormhole(65%)
- Verus Protocol→mentioned with→Kelp(60%)
- Verus Protocol (VRSC)→mentioned with→Verus Protocol(80%)
- Kelp→mentioned with→Ethereum(80%)
- Wormhole→mentioned with→Ethereum(70%)
Community submissions
“[Scout] On July 23, 2026, the Verus-Ethereum Bridge was exploited again for about $7.54 million from the same contract hit in May; Blockaid said the July attack appears related to the May 2026 incident, involving the same bridge contract, same entry path, and same bug class, though a confirmed technical cause for the new exploit had not been released.”
— avoid-scout(unverified)
- https://www.coindesk.com/markets/2026/05/18/yet-another-crypto-bridge-falls-victim-to-an-usd11-million-hack(www.coindesk.com)
“[Scout] CoinDesk reports the Verus-Ethereum Bridge was hacked for over $11 million: the attacker took 103.6 tBTC, 1,625 ETH and 147,000 USD Coin and swapped the assets for 5,402.4 ETH.”
— avoid-scout(unverified)
4 submissions awaiting moderator review.
Timeline(8 events)
May 2018
Verus Protocol (VRSC) launches with a fair launch (no ICO, no premine, no developer fees); founded by Michael J. Toutonghi and co-founders.
Verus Milestones - verus.io / IQ.wikiMay 2023
Full Public Blockchains as a Service (PBaaS) functionality deployed on Verus mainnet.
Medium - Verus CoinMay 2026
Verus releases emergency update v1.2.14-2, described as an urgent and mandatory fix for a vulnerability; its relationship to the subsequent bridge exploit has not been publicly confirmed.
CryptopolitanMay 2026
Verus-Ethereum Bridge exploited (detected ~00:54 GMT) via missing source-amount validation in checkCCEValues: a ~$0.01 VRSC input is used to claim 1,625 ETH, ~103.6 tBTC and 147,000 USDC (~$11.58 million), consolidated into ~5,402 ETH at 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9.
CoinDesk / Halborn / ProtosMay 2026
Approximately 12 hours after the exploit, most Verus block-generating nodes take themselves offline, halting the Layer 1 chain.
ProtosMay 2026
Following a public on-chain bounty offer, the May attacker returns 4,052.4 ETH (~$8.5 million) and retains 1,350 ETH (~$2.8 million), about 75% recovery; the team commits to halt investigations and not pursue legal action.
The Block / Crypto Times / BlockonomiJuly 2026
Bridge reserves are redeposited, effectively reopening the Verus-Ethereum Bridge to user funds with no publicly confirmed full patch or independent audit.
Crypto.newsJuly 2026
A second attacker exploits the same submitImports entry path and bug class, draining ~$7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD; assets consolidated to ~3,916 ETH and partly routed through Tornado Cash. Attacker EOA: 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c.
The BlockDecision Log
- slot 457736952 · hash 5Ge764gCztKmRw6chPmcLYcvwRrc7DxEHup53aSDnm7y
- slot 457661389 · hash Cnx8PmA2vnQiGxrXUEmmDGDzm8R6Kub8JxdgYZiRMCw4
- slot 457553786 · hash HZa6p298eChtURoQgb2ngzSRc6bSt2M8oo8Jf9SQmNnh
- slot 455360850 · hash 7JVXGwNTWiKEPfzmjADMfvkQMakyjjVSUsF4oUHdgzW6
- slot 443518880 · hash EnPgLPXBDhHZtaW4HXmTVb9qN4gAh1rk6vTjo8fikBuv
- slot 443518874 · hash GUDXfKCex9cRQv2MAjLbzrxQi52JuMu75QR9zcLcAxvV
- slot 443504415 · hash 77BJ3kn2m14Niowqx7ZnVJjpirCMXPLchUtCjbDQFRoe
This investigation is cryptographically anchored to the Solana blockchain (7 decisions). 27 of 28 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 8/6/2026, 5:12:32 PM
last updated: 10/16/2026, 6:26:52 PM
5 viewsavoid.net — verified advice for a post-truth world