The Verus Protocol Ethereum bridge has suffered an exploit that has allowed an attacker to siphon off greater than $11.5 million in crypto belongings via what safety researchers described as a cast cross-chain switch message.
Abstract
- Verus Protocol’s Ethereum bridge misplaced greater than $11.5 million after attackers reportedly used a cast cross chain switch message.
- Blockchain safety corporations Blockaid, PeckShield, and ExVul linked the exploit to lacking validation checks contained in the bridge verification course of.
Based on onchain safety platform Blockaid, the exploit was detected late Sunday after its monitoring programs flagged suspicious exercise tied to the Verus-Ethereum bridge. Blockaid recognized the attacker pockets as “0x5aBb…D5777” and stated the stolen funds had been initially moved into one other deal with labeled “0x65C…C25F9.”
Information shared by blockchain safety agency PeckShield confirmed that the drained belongings included 103.6 tBTC, 1,625 ETH, and almost 147,000 USDC. PeckShield later reported that the attacker swapped the stolen tokens into 5,402 ETH, valued at roughly $11.4 million primarily based on present costs.
Hours earlier than the exploit happened, PeckShield stated the attacker’s pockets had acquired 1 ETH via crypto mixer Twister Money, a element that always seems in assaults involving makes an attempt to obscure transaction origins.
Additional evaluation from GoPlus Safety indicated that the attacker first despatched a low-value transaction to the bridge contract earlier than invoking a operate that prompted reserve belongings to be batch-transferred to the drainer pockets.
GoPlus stated the exploit was “extremely probably” tied to both cross-chain message validation failure, withdrawal logic bypass, or an entry management weak point contained in the bridge mechanism.
Providing a extra particular clarification, Blockaid later said that the incident resembled the 2022 Nomad Bridge exploit and Wormhole exploit assaults, the place fraudulent switch directions tricked protocols into releasing reserve funds.
In a follow-up technical evaluation, Blockaid stated the exploit was “not an ECDSA bypass,” “not a notary key compromise,” and “not a parser/hash-binding bug.” As an alternative, the agency attributed the difficulty to “a lacking source-amount validation in checkCCEValues,” describing it as a flaw that would reportedly be mounted with round 10 strains of Solidity code.
Blockchain safety supplier ExVul reached an identical conclusion, saying the attacker used a “cast cross-chain import payload” that efficiently handed the bridge’s verification course of. Based on ExVul, the exploit finally triggered three separate transfers from the bridge reserves into the attacker-controlled pockets.
ExVul added that cross-chain proof programs ought to immediately tie switch execution to authenticated payload information earlier than funds are launched. The agency additionally really useful stricter payload validation, layered verification protections, and emergency pause mechanisms for uncommon outbound transfers.
Bridge exploits proceed to hit DeFi sector
Launched in 2023, the Verus-Ethereum bridge permits customers to maneuver and convert belongings between the Verus community and Ethereum. The protocol itself was launched in 2018 and operates utilizing a hybrid proof-of-work and proof-of-stake consensus mannequin.
As of publication, the Verus workforce had not publicly commented on the exploit.
The incident has arrived throughout a yr already hit by a number of main decentralized finance breaches. Based on safety monitoring information cited within the further stories, crypto hackers stole greater than $168.6 million from 34 DeFi protocols in the course of the first quarter of 2026 alone.
April accounted for 2 of the biggest assaults recorded this yr, together with the reported $280 million Drift Protocol exploit and the $292 million Kelp exploit.
Over the weekend, cross-chain liquidity protocol THORChain additionally confirmed struggling a separate $10 million exploit, including to mounting considerations surrounding bridge and interoperability infrastructure throughout the DeFi sector.
