The Same Bug Robbed Verus Twice in Two Months. This Time for $7.54M
In May, an attacker drained $11.5 million from the Verus-Ethereum bridge through one unverified function. In July, a completely different attacker used the exact same path to take $7.54 million more.
On July 23, 2026, an attacker drained roughly $7.54 million from the Verus-Ethereum bridge, taking ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD out of the bridge's reserves. It was the second time in a little over two months that Verus lost money to the exact same vulnerability.
Verus is a privacy-focused blockchain project running its own smart-transaction platform alongside a set of identity and interoperability tools, built around its native VRSC token. The Verus-Ethereum bridge exists specifically to move value between the two networks, letting assets deposited on one chain unlock an equivalent amount on the other. That bridge is now responsible for two of the project's largest security incidents on record, both traceable to the same unresolved logic gap.
The flaw lives in a function called VerusProof.checkExportAndTransfers, part of the code that verifies cross-chain transfers between Verus and Ethereum before releasing funds on the other side. The function checks that a transfer's hash matches what it expects. It does not check that the assets behind that transfer were actually backed by anything real on the source chain. An attacker who understands that gap can submit a transfer that looks valid on paper and walk away with funds that were never actually deposited. This class of bug, sometimes called an import-path or proof-verification flaw, is a known failure mode across cross-chain bridges generally: the bridge trusts that a message saying "funds were deposited here" is accurate, without independently confirming it against the source chain's actual state.
That gap first got exploited in May 2026, when an attacker used the same import path to pull $11.5 million from the bridge. Verus responded with what it believed was a fix and moved on. Blockaid confirmed that the July 23 attack used the same contract, the same entry path, and the same vulnerability class as May's hack, this time carried out by a completely different wallet with no apparent connection to the first attacker. Whatever got changed in May did not address the actual bug.
The July attack did not happen in isolation. It landed inside what on-chain analytics platform Lookonchain dubbed "Hackers' Day," a stretch of roughly seven hours on July 23 that also saw AFX Trade lose $24.15 million to a compromised validator quorum on its Arbitrum bridge and B² Network lose $3.86 million in a separate exploit, pushing combined losses across the three incidents to $35.55 million in a single day. Verus's number was smaller than AFX Trade's, but arguably more damning: AFX Trade had never been hit this way before. Verus had, in this exact spot, ten weeks earlier.
The stolen funds moved quickly toward known laundering channels, following the pattern security researchers have flagged across nearly every major bridge hack since 2022. CertiK's first-half 2026 report already had cross-chain bridges marked as one of the costliest attack categories of the year, with wallet and infrastructure compromises outpacing smart contract bugs for the first time. Verus now has the rare distinction of appearing in that count twice for the identical reason.
There's a version of this story where a team gets hit once, patches wrong, and the mistake looks reasonable until it isn't. Verus doesn't get that excuse twice. The second attacker didn't need to find anything new. They just had to notice that nobody had actually closed the door the first time.
The Aftermath
Verus has not published a detailed post-mortem on why the May fix failed to close the underlying gap, nor confirmed whether a new patch has since been deployed. The stolen funds from both the May and July incidents remain unrecovered as of publication. No arrests or named suspects have been announced for either attack.
COMMENTS