← Verus Protocol (VRSC)reviewed 2026-10-16 · 31 claims checked
Fact-check findings
What an automated fact-checker found when it re-read Verus Protocol (VRSC) against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
disputed
8 claimsThe reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.
- #15[disputed][awaiting moderator]in section: Bridge Reopening Without Confirmed Patch
“No information was disclosed in contemporaneous reporting about a confirmed full patch deployment or an independent third-party security audit of the bridge contract following the May recovery.”
reviewerNo confirmed full patch deployment or independent audit followed the May recovery; the bridge reopened around July 8, 2026 in that state.A publicly documented patch/restoration release (v1.2.17, v1.2.17-1) did exist and was announced before reopening; it is not accurate to say no information was disclosed about a patch. What remains true and unconfirmed is an independent third-party audit. The July repeat exploit shows the v1.2.17 fix was insufficient (it addressed checkCCEValues but not a related validation gap in checkExportAndTransfers per Rekt), but that is a different claim from 'no patch was disclosed.'Proposed correction (not yet applied)Verus publicly released version 1.2.17 on July 3, 2026, described by the project as an urgent and mandatory Verus-Ethereum bridge restoration and recovery update, but no independent third-party security audit of the bridge contract following the May recovery has been identified in contemporaneous reporting. - #16[disputed][awaiting moderator]in section: Bridge Reopening Without Confirmed Patch
“On approximately July 8, 2026, about six weeks after the exploit, bridge reserves were redeposited, effectively reopening the bridge to user funds. Researchers have not identified any public announcement confirming a verified patch or audit before this reopening, and the decision left the same vulnerable contract active and sufficiently capitalized to enable a second material exploit.”
reviewerBridge reserves were redeposited around July 8, 2026, reopening the bridge with no publicly confirmed patch or audit, leaving the vulnerable contract active.Same underlying issue as the preceding finding: a public patch announcement did exist (v1.2.17 series); only the independent-audit gap is accurately unconfirmed.Proposed correction (not yet applied)On approximately July 8, 2026, about six weeks after the exploit, bridge reserves were redeposited as part of the publicly announced v1.2.17 restoration update, effectively reopening the bridge to user funds. Researchers have not identified any independent audit confirming the v1.2.17 patch was sufficient before this reopening, and the decision left a related validation gap active and sufficiently capitalized to enable a second material exploit. - #23[disputed][awaiting moderator]in section: Security Governance and Audit Gaps
“Multiple security researchers identified the decision to reopen the bridge and replenish reserves on approximately July 8, 2026, without confirming a verified patch or publishing a technical post-mortem, as the direct governance failure that enabled the repeat attack.”
reviewerMultiple security researchers identified the decision to reopen the bridge around July 8, 2026 without confirming a verified patch or publishing a technical post-mortem as the direct governance failure enabling the repeat attack.Same defect as the other 'no confirmed patch' findings: Verus did publicly announce a patch/restoration release (v1.2.17) before the July 8 reopening, even though it ultimately proved insufficient. The 'no patch' framing overstates what is actually unverified, which is independent audit.Proposed correction (not yet applied)Multiple security researchers identified the decision to reopen the bridge and replenish reserves on approximately July 8, 2026, without an independent audit confirming the v1.2.17 patch was sufficient or a published technical post-mortem, as the direct governance failure that enabled the repeat attack. - #24[disputed][awaiting moderator]in section: Protocol TVL and Market Impact
“one report noted TVL declined from approximately $100 million at the start of 2025 to approximately $9 million by the time of the July 2026 attack”
reviewerThe Verus-Ethereum Bridge's TVL declined from approximately $100 million at the start of 2025 to approximately $9 million by the time of the July 2026 attack.The cited source (CoinCentral) does not actually contain any TVL figures. An independent source (Rekt, citing DeFiLlama) gives a different start-of-2025 figure (~$90M, not $100M); the ~$9M figure has some independent support from a DeFiLlama snapshot cited elsewhere.Proposed correction (not yet applied)one report noted TVL declined from approximately $90 million at the start of 2025 to approximately $9 million by the time of the July 2026 attack - #26[disputed][awaiting moderator]in section: Protocol TVL and Market Impact
“The combined nominal losses from the two exploits, $19.12 million, exceed the lower-end market capitalization estimates for VRSC itself, indicating a disproportionate impact relative to the project's scale.”
reviewerThe combined nominal losses from the two exploits, $19.12 million, exceed the lower-end market capitalization estimates for VRSC itself.Internal math error: $11.58M + $7.54M = $19.12M, which is below, not above, the page's own stated lower-end market-cap estimate of $22 million (19.12/22 is about 87%). The claim contradicts a figure stated earlier in the same section.Proposed correction (not yet applied)The combined nominal losses from the two exploits, $19.12 million, approach the lower-end market capitalization estimates for VRSC itself, indicating a disproportionate impact relative to the project's scale. - #29[disputed][awaiting moderator]in section: Broader Context: 2026 Bridge Exploit Landscape
“Analysts also cited the rsETH hack in April 2026 ($290 million) and the Kelp DAO incident ($293 million) among notable 2026 incidents.”
reviewerAnalysts cited the rsETH hack in April 2026 ($290 million) and the Kelp DAO incident ($293 million) as two separate notable 2026 incidents.The 'rsETH hack' and the 'Kelp DAO incident' are the same event (Kelp DAO's rsETH liquid-restaking token was exploited), reported at slightly different dollar figures by different outlets. The page double-counts one incident as two.Proposed correction (not yet applied)Analysts also cited the Kelp DAO rsETH hack in April 2026 (reported at approximately $290 million to $293 million depending on source) among notable 2026 incidents. - #30[disputed][awaiting moderator]in the timeline
“Bridge reserves are redeposited, effectively reopening the Verus-Ethereum Bridge to user funds with no publicly confirmed full patch or independent audit.”
reviewerBridge reserves were redeposited, effectively reopening the Verus-Ethereum Bridge, with no publicly confirmed full patch or independent audit.Same defect as the other 'no confirmed patch' findings in the summary and sections[4]/[7]: a patch was in fact publicly released and announced (v1.2.17 series) ahead of the July 8 reopening; only independent audit confirmation is accurately described as absent.Proposed correction (not yet applied)Bridge reserves are redeposited, effectively reopening the Verus-Ethereum Bridge to user funds after Verus released version 1.2.17 as a public bridge-restoration update, but with no independent third-party audit. - #31[disputed][awaiting moderator]in the summary
“The team recovered most of the first loss through a negotiated bounty but reopened the bridge on about July 8 without a confirmed patch or independent audit, which enabled the repeat attack and raises serious concerns about security governance.”
reviewerThe team recovered most of the first loss through a negotiated bounty but reopened the bridge on about July 8 without a confirmed patch or independent audit, enabling the repeat attack.Same underlying error repeated in the summary: the page states flatly that there was no confirmed patch, when Verus in fact publicly released and documented a patch (v1.2.17 series) that simply turned out to be insufficient against a related validation gap exploited in July.Proposed correction (not yet applied)The team recovered most of the first loss through a negotiated bounty but reopened the bridge on about July 8 after publicly releasing version 1.2.17 as a bridge-restoration update but without an independent third-party audit, and that patch proved insufficient to prevent the repeat attack, raising serious concerns about security governance.
unverifiable
3 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #4[unverifiable][awaiting moderator]in section: Project Background
“along with co-founders including Alex R. English, David Dawes, and Asher Dawes”
reviewerVerus was co-founded by Michael J. Toutonghi along with Alex R. English, David Dawes, and Asher Dawes.David Dawes is independently corroborated as an early developer. No independent source found naming Alex R. English or Asher Dawes as co-founders, but nothing contradicts it either. - #7[unverifiable][awaiting moderator]in section: Project Background
“Full Public Blockchains as a Service (PBaaS) functionality was deployed in May 2023, enabling users to launch interconnected blockchains that inherit security and features from the Verus mainchain”
reviewerFull PBaaS functionality was deployed on the Verus mainnet in May 2023.PBaaS is a real, well-documented Verus feature, but the specific May 2023 mainnet deployment date could not be independently confirmed because the cited Medium post could not be fetched. - #28[unverifiable][awaiting moderator]in section: Broader Context: 2026 Bridge Exploit Landscape
“about 41% of all tracked DeFi exploit losses in that period”
reviewerThe 2026 bridge-exploit losses represented about 41% of all tracked DeFi exploit losses in that period.Neither cited source contains this specific percentage, and no independent source confirming or contradicting it was found.
partially supported
1 claimThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Project Background
“launched in May 2018 (May 21, 2018 per the project's milestones) with a fair launch”
reviewerVerus launched on May 21, 2018, per the project's milestones page specifically.May 21, 2018 is well-supported by independent third-party sources, but it is misattributed to the Verus milestones page, which only states the month.
confirmed
19 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: Project Background
“with a fair launch: no ICO, no premine, and no developer fees”
reviewerVerus had a fair launch in May 2018 with no ICO, no premine, and no developer fees.Directly confirmed by the project's own milestones page. - #3[confirmed][no action needed]in section: Project Background
“a former Vice President and Technical Fellow at Microsoft and the architect of the .NET framework”
reviewerMichael J. Toutonghi was a former Vice President and Technical Fellow at Microsoft and was involved in the architecture of the .NET framework.Corroborated across the project's own team page and independent trade press from 2011. - #5[confirmed][no action needed]in section: Project Background
“Verus is a fork of Komodo, which itself derives from Zcash, incorporates zk-SNARK-based privacy technology, and uses a hybrid consensus mechanism called Proof of Power (PoP) combining 50% proof-of-work and 50% proof-of-stake”
reviewerVerus is a fork of Komodo (itself derived from Zcash), uses zk-SNARK privacy technology, and a 50/50 PoW/PoS hybrid consensus called Proof of Power.Consistent with general public reporting and the project's own documentation. - #6[confirmed][no action needed]in section: Project Background
“Its native token, Verus Coin (VRSC), has a maximum supply of 83,540,184 VRSC”
reviewerVRSC has a maximum supply of 83,540,184 VRSC.Directly confirmed by the project's own site and multiple data aggregators. - #8[confirmed][no action needed]in section: Pre-Exploit Emergency Update
“On May 16, 2026, two days before the first bridge exploit, Verus released version 1.2.14-2, described by the project as an urgent and mandatory emergency update to address a vulnerability.”
reviewerOn May 16, 2026, Verus released v1.2.14-2 as an urgent, mandatory emergency update, two days before the first bridge exploit.Confirmed, including the appropriately hedged statement that no confirmed link to the exploited vulnerability has been established. - #9[confirmed][no action needed]in section: May 2026 Bridge Exploit — $11.58M
“On May 18, 2026, at approximately 00:54 GMT, security firm Blockaid detected suspicious activity involving the Verus-Ethereum Bridge contract, and an attacker drained approximately $11.58 million.”
reviewerOn May 18, 2026 at approximately 00:54 GMT, Blockaid detected suspicious activity and an attacker drained approximately $11.58 million from the Verus-Ethereum Bridge.The date, amount, and Blockaid attribution are solidly corroborated across multiple outlets. The precise minute (00:54 GMT) could not be independently re-verified since the cited CCN article blocked automated fetching, and one other outlet gives a different clock time for 'compromise,' but this is a minor detail that does not affect the substance of the claim. - #10[confirmed][no action needed]in section: May 2026 Bridge Exploit — $11.58M
“The stolen assets comprised 1,625 ETH, approximately 103.6 tBTC (103.57 tBTC in one report; Threshold Network tokenized bitcoin), and 147,000 USDC.”
reviewerThe stolen assets comprised 1,625 ETH, approximately 103.6 tBTC, and 147,000 USDC.Matches PeckShield figures as reported across Merkle Science, Halborn, and multiple news outlets. - #11[confirmed][no action needed]in section: May 2026 Bridge Exploit — $11.58M
“Merkle Science and Halborn identified the root cause as a missing source-amount validation in the bridge's checkCCEValues function.”
reviewerThe missing source-amount validation was in the bridge's checkCCEValues function; the exploit used a transfer blob with only ~$0.01 of VRSC input to drain ~$11.58M, costing ~$10 in fees.Both cited technical sources were fetched directly and confirm this description in detail. - #12[confirmed][no action needed]in section: May 2026 Bridge Exploit — $11.58M
“Approximately 12 hours after the exploit began, most Verus block-generating nodes voluntarily took themselves offline, halting the Layer 1 chain.”
reviewerApproximately 12 hours after the exploit began, most Verus block-generating nodes voluntarily took themselves offline, halting the Layer 1 chain.Confirmed via The Block's reporting of the same Verus statement. - #13[confirmed][no action needed]in section: Bounty Negotiation and Fund Recovery
“On or around May 22, 2026, the attacker complied, returning 4,052.4 ETH (approximately $8.5 million) and retaining 1,350 ETH, roughly 75% recovery with the bounty representing approximately 25% of the stolen value.”
reviewerOn or around May 22, 2026, the attacker returned 4,052.4 ETH (~$8.5M) and kept 1,350 ETH (~$2.8M, ~25%), roughly 75% recovery.Well corroborated across multiple outlets fetched directly. - #14[confirmed][no action needed]in section: Bounty Negotiation and Fund Recovery
“The team also committed to halting ongoing investigations and forgoing further legal or extralegal action provided the terms were met, and clarified that the arrangement operated independently of law enforcement channels.”
reviewerThe Verus team committed to halting ongoing investigations and forgoing further legal/extralegal action if the bounty terms were met, independent of law enforcement.Directly confirmed. - #17[confirmed][no action needed]in section: July 2026 Repeat Exploit — $7.54M
“On July 23, 2026 at 03:45 UTC, a second attacker drained approximately $7.54 million from the Verus-Ethereum Bridge through exploit transaction 0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099.”
reviewerOn July 23, 2026 at 03:45 UTC, a second attacker drained ~$7.54M via exploit transaction 0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099.Date, time, and amount are well corroborated. The specific transaction hash could not be independently cross-verified against a second source in the time available, though nothing contradicts it. - #18[confirmed][no action needed]in section: July 2026 Repeat Exploit — $7.54M
“The attacker-controlled EOA was 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c, with loot wallet 0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54.”
reviewerThe attacker-controlled EOA was 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c, with loot wallet 0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54.Both addresses independently corroborated. - #19[confirmed][no action needed]in section: July 2026 Repeat Exploit — $7.54M
“Assets stolen included approximately 1,137.45 ETH, 71.50 tBTC v2, 149,275 USDC, 78,300 USDT, 31,475 EURC, 59.43 MKR, 92,784 scrvUSD, and approximately 220,357 DAI in internal transfers.”
reviewerAssets stolen in July included ~1,137.45 ETH, 71.50 tBTC v2, 149,275 USDC, 78,300 USDT, 31,475 EURC, 59.43 MKR, 92,784 scrvUSD, and ~220,357 DAI.Matches Rekt's detailed technical breakdown closely. - #20[confirmed][no action needed]in section: July 2026 Repeat Exploit — $7.54M
“Blockaid confirmed the attack used the same bridge contract, same entry path (submitImports) and same bug class as the May exploit, releasing reserves without matching value committed on the Verus source chain. The July attacker made no recovery offer and returned no funds.”
reviewerBlockaid confirmed the July attack used the same bridge contract, same entry path (submitImports), and same bug class as May; the July attacker made no recovery offer.Confirmed directly from the cited source. - #21[confirmed][no action needed]in section: Technical Vulnerability Analysis
“Merkle Science assessed that the fix required approximately 10 lines of Solidity code. Blockaid described both incidents as involving the same contract, entry path and bug class, indicating the flaw was not fully remediated between May and July. Blockaid, Halborn and Merkle Science classified the vulnerability as a gap between source-chain proof verification and destination-chain value binding, the same class as the Wormhole (February 2022, $320 million) and Nomad (August 2022, $190 million) bridge exploits.”
reviewerMerkle Science assessed that the fix required approximately 10 lines of Solidity code, and the vulnerability is the same class as the Wormhole (Feb 2022, $320M) and Nomad (Aug 2022, $190M) exploits.Figures for the comparison bridge hacks are within commonly reported ranges. - #22[confirmed][no action needed]in section: Security Governance and Audit Gaps
“including mitigations for network denial-of-service vulnerabilities ported from Zcash updates (addressed in v1.2.4), but the absence of a public bridge audit is a notable gap for a bridge that held over $11 million in user assets”
reviewerThe Verus core protocol received security patches including mitigations for network DoS vulnerabilities ported from Zcash, addressed in v1.2.4; no independent bridge audit has been identified.The v1.2.4/Zcash DoS claim checks out, and no independently published third-party audit of the bridge contracts specifically was found in this review either. - #25[confirmed][no action needed]in section: Protocol TVL and Market Impact
“The VRSC token's market capitalization was reported at varying figures in mid-2026, from approximately $22 million to $74 million depending on source and timestamp.”
reviewerVRSC's market capitalization was reported at varying figures in mid-2026, from approximately $22 million to $74 million depending on source and timestamp.The claim is explicitly hedged as varying by source/timestamp, and a data point found during this review ($60M+ in May) falls within the stated range. - #27[confirmed][no action needed]in section: Broader Context: 2026 Bridge Exploit Landscape
“the May Verus incident brought cumulative bridge-related exploit losses in 2026 to approximately $328.6 to $329 million across eight major incidents in the first five months of the year”
reviewerThe May Verus incident brought cumulative bridge-related exploit losses in 2026 to approximately $328.6 to $329 million across eight major incidents in the first five months of the year.Confirmed via PeckShield's original figures, corroborated by multiple outlets.
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.