Wormhole

DeFi

Echo Protocol

Verus

Tornado Cash

Two DeFi protocols were drained on the same day — and together they add another $87 million to a 2026 running total that has already passed $6 billion in total crypto theft since January.
The Verus-Ethereum Bridge, a cross-chain protocol designed for decentralized asset transfers between the Verus privacy network and Ethereum, was <a href="https://x.com/WuBlockchain/status/2056939490569314620?s=20" rel="noopener noreferrer nofollow">exploited</a> for more than $11 million on Friday. Before that, Echo Protocol — a Bitcoin liquidity aggregation layer recently deployed on the Monad blockchain — <a href="https://x.com/Alaouicapital/status/2056692854248894927?s=20" rel="noopener noreferrer nofollow">lost</a> $76 million to a compromised admin key attack.
Two exploits. One day. Two entirely different attack vectors. The same outcome.
How the Verus Bridge Was Broken
The Verus exploit targeted a verification flaw in how the bridge’s smart contracts communicated between the Verus chain and Ethereum. According to Blockaid’s analysis, the vulnerability bore a structural resemblance to previous high-profile bridge attacks — specifically Wormhole and Nomad — both of which were caused by failures to properly validate that source-chain parameters matched the payment data being processed on the Ethereum side.
In practice, the attacker exploited a parser flaw between Verus and Ethereum smart contracts that allowed fraudulent withdrawal transactions to be recognized as legitimate cross-chain exports. The bridge accepted the fake transactions as valid and released funds accordingly. Blockaid noted the fix required approximately ten lines of code — a detail that underscores how catastrophically expensive small verification gaps can be when they sit inside high-value cross-chain infrastructure.
The funds used to execute the exploit were sourced carefully. Verus confirmed that the attack capital came from Tornado Cash on Ethereum and from a community faucet on Verus — both accessed minutes before the exploit was executed, with deliberate steps taken to obscure the origin of the requests.
Verus was <a href="https://x.com/VerusCoin/status/2056829444124213652?s=20" rel="noopener noreferrer nofollow">direct </a>about the sophistication of what it faced:
<blockquote>
 “The attack was multi-step, well planned, and sophisticated, almost certainly aided by AI and demonstrating a deep understanding of what they could and could not do in the protocol.”
</blockquote>
The aftermath was significant beyond the financial loss. Multiple Verus block-producing nodes failed validation checks following the exploit, pushing the chain to the edge of a complete halt. DeFi operations were emergency-disabled to stabilize the network and prevent further damage — a drastic step that underscores how deeply the exploit disrupted the protocol’s core infrastructure.
The Echo Protocol Incident: A Different Attack, Same Outcome
While the Verus bridge was being exploited through a verification flaw, Echo Protocol was simultaneously being drained through an entirely different mechanism — a compromised admin key.
Echo Protocol, which describes itself as a Bitcoin liquidity aggregation and yield infrastructure layer, had just deployed on the Monad blockchain when the attack occurred. The timing was not coincidental. New deployments represent the highest-risk window for protocols — code is live, liquidity is present, and the team’s attention is divided between monitoring the new environment and managing existing operations.
Using the compromised admin key, the attacker minted 1,000 unauthorized eBTC tokens worth approximately $77 million — creating assets out of nothing and immediately beginning to move them. The team regained control of the compromised key quickly, but not before the damage was done. By the time of reporting, the attacker had already laundered approximately $816,000 through Tornado Cash, with the remainder of the funds still being tracked.
The $76 million figure makes the Echo Protocol exploit one of the largest single-incident losses of May 2026 — and the combination of the two attacks in a single day represents one of the worst 24-hour periods for DeFi security the industry has seen this year.
Two Different Vulnerabilities, One Systemic Problem
The Verus and Echo incidents illustrate the breadth of the attack surface that DeFi infrastructure presents — and why the industry’s security crisis in 2026 has proven so difficult to address through any single category of fix.
The Verus exploit was a classic bridge verification failure — a known category of vulnerability that has produced some of crypto’s largest losses, from the $325 million Wormhole hack in 2022 to the $190 million Nomad exploit the same year. Despite years of documented bridge exploits and significant investment in bridge security research, a ten-line verification gap in a 2023 bridge was still sufficient to drain $11 million in 2026.
The Echo exploit was an admin key compromise — a centralization risk that exists whenever a single key holder has minting authority over a protocol’s assets. No amount of smart contract auditing protects against an admin key being stolen or leaked. The only structural mitigation is distributing that authority across multiple parties through multisig requirements — a protection that was apparently not in place at the moment of deployment on Monad.
Together, the two incidents add to a 2026 security record that has become genuinely alarming in its scale. More than $6 billion has been drained from DeFi protocols, individual users, and blockchain infrastructure since January — through North Korean state-sponsored operations, bridge exploits, governance attacks, private key compromises, and now a parser flaw that Blockaid says could have been fixed with ten lines of code.
The exploits keep coming. The attack vectors keep rotating. And the cumulative bill keeps growing.

Verus-Ethereum Bridge Exploited for $11 Million — While Echo Protocol Loses $76 Million on Same Day

CoinstelegramEng

Other articles published on May 20, 2026

Join our free newsletter for daily crypto updates!