Skip to main content
AVOID.NET

Verus Protocol (VRSC)

avoid.net/verus-protocol-vrsc→26/100·82% conf.
[AI-DRAFTED · AWAITING FACT-CHECK]

Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 20 → 26. Problems weighed by who is responsible: concerns that are not fraud −26, incidents the subject suffered −20, problems around the subject, caused by others −1.8; legitimacy credit long-running +10; no established finding that it defrauded anyone, so it stays out of the red band; the penalty for incidents it suffered is capped at 20; a recent unresolved incident −15.5. Version history →

Why this score
Every page starts at65
Concerns that are not fraud-26
Incidents it suffered (e.g. hacks)-20
Problems around it, caused by others-1.8
Long-running+10
Recent unresolved incident-15.5
Sum12
  • The penalty for incidents it suffered is capped at 20 points.

Score: 26/100 (kept between 0 and 100)

How scoring works →
anchored·ecmggi…jPwq
last updated 2026-10-10

Summary

Verus Protocol (VRSC) is an open-source, fair-launched, privacy-focused blockchain launched in May 2018 by Michael J. Toutonghi, offering hybrid proof-of-work/proof-of-stake consensus, VerusID and Public Blockchains as a Service (PBaaS). Its Ethereum cross-chain bridge was exploited twice in 2026, for about $11.58M on May 18 and about $7.54M on July 23, through the same missing source-amount validation in the bridge's import path. The team recovered most of the first loss through a negotiated bounty but reopened the bridge on about July 8 without a confirmed patch or independent audit, which enabled the repeat attack and raises serious concerns about security governance.

Connected Entities

5 entities · 59 linked investigations
Organizations
□Kelp59□Ethereum90□Wormhole
Protocols
⌂Verus Protocol (VRSC)⌂Verus Protocol
Relationships
  • Verus Protocol (VRSC)→mentioned with→Wormhole(65%)
  • Verus Protocol (VRSC)→mentioned with→Ethereum(80%)
  • Verus Protocol→mentioned with→Ethereum(80%)
  • Verus Protocol→mentioned with→Wormhole(65%)
  • Verus Protocol→mentioned with→Kelp(60%)
  • Verus Protocol (VRSC)→mentioned with→Verus Protocol(80%)
  • Kelp→mentioned with→Ethereum(80%)
  • Wormhole→mentioned with→Ethereum(70%)
Also appears in
Aperture LM·58Crossmint·83Bedrock Protocol·58BNB Chain Bridge·51StakeDAO — vsdCRV Deployer Key Exploit (May 2026)·38Stake DAO·57Nobitex June 2025 Hack (Predatory Sparrow)·10Robinhood Crypto·40June 2026 Cross-Chain Bridge Exploit ($127M, Three Protocols)·8KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus·0
Have evidence about Verus Protocol (VRSC)?
0
Accepted
6
Under review
0
Rejected / revoked

6 submissions awaiting moderator review.

Timeline(8 events)

May 2018

Verus Protocol (VRSC) launches with a fair launch (no ICO, no premine, no developer fees); founded by Michael J. Toutonghi and co-founders.

Verus Milestones - verus.io / IQ.wiki

May 2023

Full Public Blockchains as a Service (PBaaS) functionality deployed on Verus mainnet.

Medium - Verus Coin

May 2026

Verus releases emergency update v1.2.14-2, described as an urgent and mandatory fix for a vulnerability; its relationship to the subsequent bridge exploit has not been publicly confirmed.

Cryptopolitan

May 2026

Verus-Ethereum Bridge exploited (detected ~00:54 GMT) via missing source-amount validation in checkCCEValues: a ~$0.01 VRSC input is used to claim 1,625 ETH, ~103.6 tBTC and 147,000 USDC (~$11.58 million), consolidated into ~5,402 ETH at 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9.

CoinDesk / Halborn / Protos

May 2026

Approximately 12 hours after the exploit, most Verus block-generating nodes take themselves offline, halting the Layer 1 chain.

Protos

May 2026

Following a public on-chain bounty offer, the May attacker returns 4,052.4 ETH (~$8.5 million) and retains 1,350 ETH (~$2.8 million), about 75% recovery; the team commits to halt investigations and not pursue legal action.

The Block / Crypto Times / Blockonomi

July 2026

Bridge reserves are redeposited, effectively reopening the Verus-Ethereum Bridge to user funds with no publicly confirmed full patch or independent audit.

Crypto.news

July 2026

A second attacker exploits the same submitImports entry path and bug class, draining ~$7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD; assets consolidated to ~3,916 ETH and partly routed through Tornado Cash. Attacker EOA: 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c.

The Block
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain27 Wayback Archives

Decision Log

  • #4rescore+6Recorded on Solana ✓10/10/2026, 6:41:39 PM
    slot 455360850 · hash 7JVXGwNTWiKEPfzmjADMfvkQMakyjjVSUsF4oUHdgzW6
  • #3review approveRecorded on Solana ✓8/26/2026, 12:03:57 AM
    slot 443518880 · hash EnPgLPXBDhHZtaW4HXmTVb9qN4gAh1rk6vTjo8fikBuv
  • #2reviewRecorded on Solana ✓8/26/2026, 12:03:57 AM
    slot 443518874 · hash GUDXfKCex9cRQv2MAjLbzrxQi52JuMu75QR9zcLcAxvV
  • #1publishRecorded on Solana ✓8/6/2026, 5:12:40 PM
    slot 443504415 · hash 77BJ3kn2m14Niowqx7ZnVJjpirCMXPLchUtCjbDQFRoe

This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 27 of 28 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-code-merge-writer

generated: 8/6/2026, 5:12:32 PM

last updated: 10/10/2026, 6:41:39 PM

4 views

avoid.net — verified advice for a post-truth world