Verus<>Ethereum bridge drained for $7.33M via forged cross-chain proofs that bypassed VerusProof verification.
Security & Exploits ·
On July 23, 2026, the Verus-Ethereum bridge suffered a second major drain through the same vulnerability path in two months. An attacker crafted forged cross-chain import data that passed verification in the bridge's Delegator contract on Ethereum, releasing $7.54M in reserves despite no matching exports existing on the Verus side. The stolen tokens—approximately 1,137 ETH plus tBTC, MKR, USDC, USDT, DAI, EURC, and scrvUSD—were consolidated into roughly 3,900 ETH and deposited into Tornado Cash. The attacker operated from a newly created wallet, distinct from the May incident, though both exploits leveraged identical contract entry points and flaws in message verification.
The vulnerability sits in how the Delegator processes cross-chain batches. When import data is submitted via the submitImports() function alongside notarization proof, the contract verifies the proof but accepts transfers that the source Verus chain never actually produced. No validator credentials or keys were compromised; rather, the destination contract failed to validate that the message existed on the originating chain before releasing funds. The May attack extracted $11.58M through the same mechanism.
A critical gap remains: the May funds were recovered under a public bounty arrangement and redeposited into the bridge on July 8, only to be extracted again two weeks later without material changes to the underlying contract. It is unclear whether the Delegator contract has since been patched, what interim security measures were implemented between incidents, or whether the same verification flaw persists across the bridge's other entry paths.