Verus Ethereum Bridge Second Exploit (July 2026)

2026-05-17

First Verus-Ethereum Bridge exploit begins. Blockaid detects suspicious activity at approximately 00:54 GMT. Attacker drains $11.58 million in ETH, tBTC, and USDC by exploiting missing source-amount validation in the bridge's checkCCEValues function.

2026-05-18

First exploit attack confirmed complete. Attacker consolidates approximately 5,402 ETH. CoinDesk reports the incident as part of a broader 2026 DeFi exploit wave exceeding $750 million.

2026-06-01

Verus team reaches settlement with May attacker. Attacker agrees to return 4,052.4 ETH (approximately $8.5 million) and retain 1,350 ETH (approximately $2.8 million) as an acknowledged bounty.

2026-07-08

Verus team redeposits recovered ETH into the same bridge contract. The bridge is reopened for use. Security analysts later note the underlying vulnerability was not patched prior to this redeposit.

2026-07-23

Second exploit occurs at approximately 03:45 UTC. A different attacker — using wallet 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c — drains approximately $7.54 million in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD via the same submitImports vulnerability. Blockaid detects and publicly discloses the incident.

2026-07-23

Attacker converts stolen assets into approximately 3,916 ETH via DEX swaps and begins routing portions through Tornado Cash to obscure fund trail. Combined Verus bridge losses reach approximately $19.1 million across both exploits.

2026-07-23

AFX Trade bridge exploited for approximately $24 million in a separate incident on the same day, contributing to a total of approximately $31.5 million in cross-chain bridge losses within 24 hours.

2026-07-26

Reporting confirms VerusCoin had issued no official post-mortem or public statement regarding the July exploit. No patch deployment or bridge reopening timeline is announced. Total weekly crypto losses attributed to bridge attacks reach over $47 million.