Security firms raised alarms after detecting unusual outflows from the Verus-Ethereum bridge contract. The incident resulted in the loss of assets worth roughly $11.5 million. Multiple blockchain monitoring platforms, including Blockaid, PeckShield, and others, tracked the activity in real time as it unfolded.

How the Exploit Unfolded

According to detailed analysis from Blockaid, the bridge performed several standard checks: a notarized state root from Verus notaries, Merkle proof for the export, and hash binding for data integrity. However, it failed to verify that the claimed source amounts on the Verus side matched the payout on Ethereum.

The attacker submitted a low-value transaction on Verus — roughly 0.02 VRSC — that included a Keccak hash of a payout blob listing much larger amounts. Notaries signed the state root as valid. On the Ethereum side, the submitImports function accepted the matching hash, decoded the blob, and released the full reserves to the attacker-controlled wallet.

Researchers emphasized this was not a compromise of notary keys, ECDSA signature bypass, or parser issue. The core problem was a gap in the checkCCEValues function. Fixing it would likely require only a small code adjustment.

Attacker Preparation

Records show the primary attacker address received 1 ETH through Tornado Cash about 14 hours before the main transactions. The wallet then interacted with the bridge contract, first with a small test transfer before triggering the larger withdrawal.

Funds were quickly consolidated and moved to a secondary address ending in C25F9. As of the latest reports, the stolen ETH remains in attacker control.

Broader Context of Bridge Risks

This marks another high-profile incident targeting cross-chain infrastructure. Bridges remain attractive targets because they lock significant liquidity while managing complex verification across different networks. Industry data shows multiple bridge exploits already this year, contributing to hundreds of millions in total losses across DeFi.

Verus, launched in 2018, uses a hybrid consensus model focused on privacy and multi-chain capabilities. Its Ethereum bridge, introduced in 2023, enables asset transfers and conversions between the two ecosystems. The project has not yet issued an official statement on recovery plans or compensation for affected users.

Verus native token (VRSC) showed limited immediate movement following the news, trading near $0.75 with modest daily changes. The broader market context includes several other large-scale DeFi incidents in recent months.

Implications for Cross-Chain Security

The event highlights ongoing challenges in bridge design, particularly around ensuring payload data directly matches executed transfers. Security teams recommend stronger validation layers, emergency pause functions, and tighter ties between proofs and fund releases.

Users of the Verus bridge are advised to monitor official channels for updates. While the project team works on next steps, the incident adds to calls for improved standards in interoperability protocols that hold substantial locked value.