tBTC

Drift

Verus

Ronin

A Verus-Ethereum<a href="https://yellow.com/asset/eth" rel="noopener noreferrer nofollow">(ETH)</a> bridge attacker drained 103.6 tBTC, 1,625 ether and 147,000 USD Coin <a href="https://yellow.com/asset/usdc" rel="noopener noreferrer nofollow">(USDC)</a> on Monday, swapping the haul for over $11 million.
<h2 id="verus-bridge-exploit-details">Verus Bridge Exploit Details</h2>
The attacker <a href="https://www.coindesk.com/markets/2026/05/18/yet-another-crypto-bridge-falls-victim-to-an-usd11-million-hack" rel="noopener noreferrer nofollow">moved</a> against the cross-chain bridge that lets users shift value between the Verus network and Ethereum, including ETH and ERC-20 assets, CoinDesk reported.
Blockchain analytics firm PeckShield<a href="https://x.com/PeckShieldAlert/status/2056194168385642881" rel="noopener noreferrer nofollow">flagged</a> the incident on social media. The exploiter later swapped the stolen tokens for 5,402.4 ETH and now sits on the proceeds at address 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9.
The stolen tBTC is Threshold Network's tokenized Bitcoin<a href="https://yellow.com/asset/btc" rel="noopener noreferrer nofollow">(BTC)</a>. Verus had marketed its bridge as a non-custodial design backed by cryptographic proofs from miners and stakers, distinct from the multisig setups that have failed in past attacks.
Also Read:<a href="https://yellow.com/news/xrp-etfs-record-139b-token-loses-bnb" rel="noopener noreferrer nofollow">XRP ETFs Hit Record $1.39B But Token Loses 4th Spot To BNB</a>
<h2 id="bridge-attacks-keep-mounting">Bridge Attacks Keep Mounting</h2>
The Monday exploit fits a familiar pattern. Attackers keep <a href="https://phemex.com/blogs/defi-hacks-2026-bridge-exploits-explained" rel="noopener noreferrer nofollow">hitting</a> the infrastructure connecting chains rather than the smart contracts running on top of them.
Crypto exchange Phemex noted that the year's two largest losses, the <a href="https://yellow.com/news/drift-protocol-exploit-solana" rel="noopener noreferrer nofollow">$285 million Drift Protocol drain in April</a> and the <a href="https://yellow.com/news/kelp-lazarus-exploit-layerzero" rel="noopener noreferrer nofollow">$292 million Kelp DAO</a> breach later that month, both traced back to cross-chain components. Four of the smaller 2026 exploits also targeted bridge-related infrastructure.
"That is no coincidence, and it matches the historical pattern in which bridge exploits consistently produce the largest individual losses in any given year," the exchange said.
<h2 id="cross-chain-risk-in-2026">Cross-Chain Risk In 2026</h2>
Bridges remain crypto's softest target this year. The <a href="https://yellow.com/news/kelp-lazarus-exploit-layerzero" rel="noopener noreferrer nofollow">Kelp DAO attack in Apr. exploited LayerZero's cross-chain messaging system</a>, releasing 116,500 rsETH to an attacker-controlled wallet and rippling damage across roughly 20 chains where wrapped ether collateral got stranded.
Drift's $285 million loss on Apr. 1 came not from a code bug but from compromised admin keys, with the stolen funds bridged to Ethereum through Circle's Cross-Chain Transfer Protocol before laundering. Total DeFi losses had already cleared $750 million by mid-April, per data from DefiLlama and PeckShield, with the Ronin Network's $552 million hack from 2022 still standing as one of the largest in crypto history.
Read Next:<a href="https://yellow.com/news/hyperliquid-rejects-manipulation-claims-hype-drops" rel="noopener noreferrer nofollow">Hyperliquid Rejects Wall Street's Manipulation Claims As HYPE Drops 14%</a>

Verus-Ethereum Bridge Bleeds $11M In Fresh Cross-Chain Attack

Table of Contents

Yellow News

Other articles published on May 18, 2026

Join our free newsletter for daily crypto updates!