Verus-Ethereum Bridge Exploited for $11.58 Million
Hackers have reportedly stolen $11.58 million from the Verus-Ethereum bridge, according to alerts from blockchain security platforms. The exploit targeted one of Verus’s cross-chain bridge contracts, resulting in the draining of reserves containing ETH, tBTC, and USDC.
Suspicious Activity Detected
Security firms CertiK and PeckShield flagged suspicious activity from the bridge contract at 0x71518580…cd7f63 within hours of the exploit. Their posts on X indicated that the stolen assets included 1,625 ETH, 103.56 tBTC, and 147,000 USDC. The attacker quickly converted the assets into approximately 5,402 ETH and transferred the funds to a separate wallet.
Technical Breakdown of the Exploit
Blockaid, another on-chain security firm, published a technical analysis of the incident. According to their report, the bridge correctly verified a notarized Verus state root, a Merkle proof of the cross-chain export, and a hash binding confirming the integrity of the transfer data. However, the bridge failed to validate whether the source-chain export’s stated amounts matched the payout.
The attacker constructed a transaction on the Verus side for approximately 0.02 VRSC, worth about $0.01, which committed a keccak hash of a payout blob while listing empty source-side totals. The Verus protocol accepted the transaction, and the notaries signed the resulting state root without issue.
On the Ethereum side, the attacker used submitImports() with a serialized transfer blob whose hash matched the committed value. The bridge then verified the hash, decoded the blob, and disbursed 1,625 ETH, 103 tBTC, and 147,000 USDC from its reserves to the attacker.
In essence, the attacker spent about $10 in VRSC fees and received $11.58 million in return. The Blockaid report noted that there was no ECDSA bypass, no compromise of notary keys, and no parser or hash-binding bug. The vulnerability stemmed from a missing source-amount validation in the “checkCCEValues” function, which, according to the security firm, could be fixed with around ten lines of Solidity code.
Broader Impact on the Crypto Sector
Certik reported that the wider crypto sector lost over $650 million to malicious actors last month, with a significant portion of that amount resulting from two incidents: an attack on KelpDAO, which led to the theft of more than $292 million, and another on Drift Protocol, which lost over $285 million.
Bridges are increasingly targeted, with the Verus exploit being the eighth incident involving such platforms this year. PeckShield estimates that attackers have stolen at least $328 million from these platforms.
Market Reaction
VRSC, the Verus native token, did not appear to react significantly to the news of the exploit. Data from CoinGecko indicates that the token remained largely flat on the day of the hack, with minimal movement in the 24-hour period leading up to the attack. At the time of writing, VRSC was trading at approximately $0.75, down 6% over 30 days, and had lost nearly 73% of its value in the past year.
