Verus-Ethereum Bridge hit by second hack as $7.54M vanishes
The second attack in two months could resemble May’s $11.58 million exploit.
The Verus-Ethereum Bridge has been hacked… again. The latest attack reportedly exploited the same weakness used before, which raises the question: is the bridge truly safe?
Verus-Ethereum bridge drained of $7.54M
Blockchain security firm Blockaid detected a new attack on the Verus-Ethereum Bridge on the 23rd of July. According to the firm, the attacker exploited the bridge’s import process to release funds without depositing matching assets on the source chain.
On-chain data shows that the exploit occurred at 03:45 UTC. Around 1,137 Ethereum [ETH], along with tBTC, USD Coin [USDC], Tether [USDT], EURC, Maker [MKR], and Savings crvUSD [scrvUSD], were transferred to an attacker-controlled wallet. Etherscan valued the main outflows at approximately $7.54 million at the time.
Blockaid noted that although the attacker used a different wallet and transaction, they still targeted the same bridge contract, entry path, and likely bug category as in the May breach.
Attack similar to May’s $11.58 million exploit
The similarities with the May breach make one wonder: Was the earlier vulnerability fully addressed?
Blockaid traced the latest funds to 0xCFd0…2D54 and said the attacker again manipulated the import process to create payouts on Ethereum without equivalent backing on the source chain.
In May, an attacker reportedly bypassed a validation check using a forged cross-chain import, draining around $11.58 million. The attacker later returned 4,052.4 ETH, then worth about $8.5 million, after Verus offered settlement terms. They retained 1,350 ETH as a bounty.
While there is belief that both attacks involve the same contract, access route, and type of flaw, a complete technical explanation is still pending.
A series of bridge attacks
What’s concerning is that this is not the only security incident reported today. Onchain tracker Lookonchain estimated that attacks affecting AFX Trade, Verus, and BSquared Network caused combined losses of around $35.55 million.
AFX recorded the largest loss at approximately $24.15 million in USDC. The attacker transferred the funds to Ethereum and exchanged them for 12,467 ETH. However, Arbitrum’s native bridge was not impacted, as the incident originated from infrastructure managed by a third-party protocol. Notably, BSquared Network reportedly lost another $3.86 million.
Final Summary
- The Verus-Ethereum Bridge lost around $7.54 million in its second major exploit in two months.
- The attack resembles May’s $11.58 million breach, but investigators have not yet determined the exact cause.
