Verus Ethereum Bridge Suffers Second $7.54 Million Exploit in Two Months

Highlights:

• The Verus Ethereum Bridge lost another $7.54 million after attackers exploited its bridge import process.
• The latest attack happened just two months after the previous Verus bridge exploit.
• Investigators are still working to determine whether the attacker reused the earlier vulnerability or found a new weakness.

The Verus Ethereum Bridge lost about $7.54 million after another exploit struck the protocol today. Blockchain security firm Blockaid’s on-chain records showed the exploit transaction reached the Verus Ethereum Bridge contract at 03:45 UTC before transferring about 1,137 ETH and several tokens.

Verus–Ethereum Bridge Suffers Second Exploit in Two Months, $7.54M Drained

Blockaid detected a new exploit targeting the Verus–Ethereum Bridge, with an attacker abusing the bridge’s import path to trigger unbacked Ethereum-side payouts and drain approximately $7.54 million in… pic.twitter.com/eNGo8EILT7

— Wu Blockchain (@WuBlockchain) July 23, 2026

Blockaid said the attacker abused the bridge’s import process to trigger Ethereum payouts without matching assets on the source chain. As a result, the attacker received Ethereum-side payouts without matching assets locked on the Verus source chain. Blockaid also confirmed that a different attacker-controlled wallet executed the July exploit instead of the wallet used during the May attack.

The exploit transferred about 1,137 ETH from the bridge. The attacker also drained tBTC, USDC, USDT, EURC, MKR and scrvUSD. Etherscan valued the stolen assets at roughly $7.54 million during the attack.

Blockaid linked the stolen funds to the wallet identified as 0xCFd0…2D54. The company also confirmed that the transaction targeted the same Verus Ethereum Bridge contract involved in the earlier breach. However, Blockaid said investigators have not confirmed the exact technical flaw that allowed the exploit.

Blockaid said the July attacker abused the same bridge import path that the May attacker used. However, Blockaid has not released a technical report confirming whether the attacker reused the May vulnerability or exploited a related weakness. Investigators are analyzing the transaction to identify the exact vulnerability that triggered the unauthorized payouts.

Verus Ethereum Bridge Exploit Raises Fresh Security Concerns

The latest exploit arrived about two months after the Verus Ethereum Bridge lost roughly $11.58 million in another attack. Security researchers said the May attack exploited a validation gap that accepted a forged cross-chain import request.

Researchers said the flaw allowed a forged cross-chain import request to pass verification even though the source chain lacked matching value. As a result, the bridge released Ethereum assets that exceeded the value committed on the Verus source chain.

The May attacker later returned 4,052.4 ETH after the Verus project offered settlement terms. The returned assets carried an estimated value of about $8.5 million at that time. However, the attacker kept 1,350 ETH as a negotiated bounty.

Cross-chain bridges hold assets on multiple blockchains, making them frequent targets for attackers seeking validation weaknesses. Every bridge transfer depends on accurate message validation, smart contract execution, and correct asset accounting across connected blockchains. Any weakness in validation, contract logic, or access controls can release Ethereum assets without matching deposits on the source blockchain.

Verus has not announced how it plans to recover the stolen assets or compensate affected users after the July 23 exploit. The Verus team also has not announced any bridge upgrades or operational changes following the latest exploit.

Three Crypto Exploits Cause $35.55 Million in Losses

The Verus exploit occurred within hours of separate attacks targeting AFX Trade and B² Network. On-chain tracker Lookonchain said AFX Trade, Verus and B² Network suffered combined reported losses of about $35.55 million.

Is today Hackers' Day?

Three exploits have already happened today, with total losses of $35.55M.

AFX Trade(@AFX_XYZ) was exploited for $24.15M.

Verus(@VerusCoin) Ethereum bridge was exploited for $7.55M.

B² Network(@BSquaredNetwork) was exploited for $3.86M. pic.twitter.com/9v1KxWtaHV

— Lookonchain (@lookonchain) July 23, 2026

Attackers stole about $24.15 million in USDC from an AFX-operated bridge, making it the largest exploit reported that day. The attacker later moved the funds to Ethereum and converted them into 12,467 ETH. Attackers also stole about $3.86 million from B² Network during a separate exploit reported the same day.

Offchain Labs said the AFX incident did not affect Arbitrum’s native bridge. Instead, Offchain Labs said the exploit targeted infrastructure operated by a third-party protocol rather than Arbitrum’s native bridge. Investigators continue tracking the attacker wallets to determine whether the stolen assets move through exchanges or other blockchain services.