$11.58M Exploit of Verus-Ethereum Bridge Exposes Cross-Chain Vulnerabilities

On May 18, 2026, the Verus Ethereum Bridge was exploited, resulting in the theft of approximately $11.58 million in assets, including ETH, tBTC, and USDC. The attack was identified by Blockaid, which reported that the exploit was still active, allowing the attacker to drain funds continuously. The vulnerability stemmed from inadequate validation checks in the bridge's transaction logic, allowing a mismatch between input and output amounts. Investigators noted that the attacker initially funded their wallet through Tornado Cash shortly before the exploit. The incident highlights ongoing security issues in cross-chain infrastructure, which has been a frequent target for attackers in the DeFi space. Security firms are analyzing the exploit to determine the exact methods used and potential weaknesses in the bridge's design. The situation remains critical as the bridge has not yet been fully secured.

Key Points: • The Verus Ethereum Bridge was exploited, leading to a loss of $11.58 million. • The attack exploited poor validation in transaction logic, allowing mismatched inputs and outputs. • The ongoing exploit raises significant concerns about the security of cross-chain bridges in DeFi.