Verus-Ethereum bridge hacked again; losses $19.1M

On July 23 attackers exploited a flaw in the Verus-Ethereum bridge and withdrew between $7.3 million and $7.5 million in digital assets. The incident is the second breach of the same contract in 66 days and brings combined losses to about $19.1 million.

The exploit used a malicious import from the Verus side that triggered an unbacked payout on Ethereum. The bridge accepted valid notary signatures, state roots and Merkle proofs but did not verify that the requested payout matched assets actually locked or exported on Verus. Security researchers described the failure as an authorization bypass caused by incorrect assumptions about protocol state.

Backward Labs analyzed the incident, published a proof-of-concept and identified missing upstream checks for creation, authorization, transfer hash, count and economic backing. The firm said the bridge released reserves for a multi-asset payout without proving that the source-chain transfers and their economic backing followed the expected bridge lifecycle.

Assets removed in the July 23 exploit included Ether, tBTC, MKR, USDC, Tether, EURC and scrvUSD. The bridge also interacted with a Sky (formerly MakerDAO) collateral position and minted about 220,357 DAI to satisfy the fraudulent request. An earlier attack on May 17 used a similar method to take roughly $11.6 million.

Blockchain monitoring tools flagged the July 23 transaction with a critical score, citing state manipulation, arbitrary minting and outbound flows from DeFi reserves. Analysts noted that while cryptographic proofs in the contract were verified, the code did not enforce business-logic checks tying payouts to verified asset movements on the source chain.

Security teams advised users to follow official Verus project channels for updates and called on protocol developers to correct the bridge’s state-check logic and require end-to-end proofs of economic backing. Bridge exploits have removed roughly $19.1 million from the Verus bridge reserves; because blockchain transactions cannot be reversed, those losses are not easily recovered.