Verus<>Ethereum bridge drained for $7.33M via forged cross-chain proofs that bypassed VerusProof verification.
Security & Exploits ·
A forged cross-chain import drained the Verus-Ethereum bridge of $7.54M on July 23, 2026, marking the second exploit of the same vulnerability in two months. The attacker submitted crafted import data that passed verification despite no corresponding export existing on the Verus chain, releasing reserves backed only by the fraudulent message; the stolen assets were converted to roughly 3,900 ETH and sent to Tornado Cash. A May incident exploited the identical contract entry path and vulnerability class for $11.58M, which was partially recovered and redeposited into the bridge on July 8 before being drained again two weeks later.