Bounty

Verus

Echo Protocol

Trump Media

<p><strong>The Verus Ethereum bridge exploiter has returned 4,052 ETH to the project team after a settlement offer, while keeping 1,350 ETH as a bounty.</strong></p>
<div id="cn-block-summary-block_150456946d8465036c52025dec8caccc" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>PeckShield says the Verus bridge exploiter returned 4,052 ETH, equal to 75% of stolen funds.</li>
   <li>The exploiter kept 1,350 ETH as a bounty after Verus proposed settlement terms publicly.</li>
   <li>Earlier reports linked the Verus bridge exploit to missing validation checks in cross-chain transfer logic.</li>
  </ul>
 </div>
</div>
<p>PeckShield said the Verus bridge exploiter returned 4,052.4 ETH, worth about $8.5 million, to a Verus team address. The firm said the returned assets represented 75% of the stolen total.</p>
<p>Etherscan data <a href="https://etherscan.io/tx/0xb428dae60a234c149c8bc4468979356c434726bf8f588b6c97bd7144aa5bcefe" rel="noopener noreferrer nofollow">shows</a> a successful transfer of 4,052 ETH from a wallet labeled Verus Exploiter 2 to the address 0xF9AB…C1A74 on May 21. The transaction was valued at about $8.59 million at the ETH price shown by the explorer.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p><a href="https://twitter.com/hashtag/PeckShieldAlert?src=hash&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">#PeckShieldAlert</a> The <a href="https://twitter.com/VerusCoin?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@veruscoin</a> Bridge exploiter has returned 4,052.4 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a> (~$8.5M) to the team address: 0xF9AB…C1A74. <br><br>The returned funds represent 75% of the stolen total, leaving a 25% bounty (1,350 <a href="https://twitter.com/search?q=%24ETH&amp;src=ctag&amp;ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">$ETH</a>, ~$2.8M) in the exploiter's wallet. <a href="https://t.co/ZFIqnHBwZk" rel="noopener noreferrer nofollow">https://t.co/ZFIqnHBwZk</a><a href="https://t.co/vPsiOigyQ5" rel="noopener noreferrer nofollow">pic.twitter.com/vPsiOigyQ5</a></p>— PeckShield <a href="https://twitter.com/PeckShieldAlert/status/2057638728890536262?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 22, 2026</a>
  </blockquote>
 </div>
</figure>
<p>PeckShield said the remaining 25% stayed with the exploiter as a bounty. A separate Etherscan transaction <a href="https://etherscan.io/tx/0x84aada67c438869ea19cf6e82fb33b3d2515b636c166dfc356eb8167a15d5e67" rel="noopener noreferrer nofollow">shows</a> 1,350 ETH, worth about $2.86 million, moved from the exploiter wallet to a new address minutes after the return transfer.</p>
<p>You might also like: <a href="https://crypto.news/trump-media-moves-over-2k-btc-to-crypto-com-what-does-it-mean-for-bitcoin/" rel="noopener noreferrer nofollow"> Trump Media moves over 2K BTC to crypto.com, what does it mean for Bitcoin? </a></p>
<figure class="wp-block-image size-large"><img width="1024" height="300" src="https://media.crypto.news/2026/05/image-173-1024x300.webp" alt="Verus bridge attacker sends back $8.5M, keeps bounty - 5">
 <figcaption>
  Source: Etherscan
 </figcaption>
</figure>
<p>Some X users <a href="https://x.com/bee_swarm/status/2057715095481004399?s=20" rel="noopener noreferrer nofollow">framed</a> the recovery as a win for negotiated returns. Bee Swarm said “75% recovery is the new standard” and argued that bounty deals can work better than legal threats after funds are gone.</p>
<p>Others said the exploit still points to deeper bridge risks. Zenthis <a href="https://x.com/zenthis_io/status/2057701991200035241?s=20" rel="noopener noreferrer nofollow">argued</a> that partial recovery does not fix “centralized custody in bridges,” while pointing to atomic swaps as an alternative.</p>
<h2 class="wp-block-heading" id="strong-bounty-offer-followed-public-verus-terms-strong"><strong>Bounty offer followed public Verus terms</strong></h2>
<p>Verus had earlier <a href="https://x.com/VerusCoin/status/2057465214975492358?s=20" rel="noopener noreferrer nofollow">posted</a> a message to the bridge exploiter, saying its community and developers had discussed terms for the fund return. The post said the terms covered the bounty size, the exploiter’s obligations, and how the assets could be returned.</p>
<p>According to the public Verus message from X, the community had agreed to a 1,350 ETH bounty. The offer was tied to returning the remaining funds and settling the matter under the proposed terms.</p>
<p>The return now makes the Verus case different from many bridge attacks, where stolen funds often move through mixers or remain under attacker control. In this case, most of the drained ETH moved back to a team address after the bounty offer.</p>
<h2 class="wp-block-heading" id="strong-earlier-exploit-drained-11-5m-strong"><strong>Earlier exploit drained $11.5M</strong></h2>
<p>The fund return follows the May 18 Verus Ethereum bridge attack. Earlier coverage <a href="https://crypto.news/verus-ethereum-bridge-drained-of-11-5m-in-forged-transfer-exploit/" rel="noopener noreferrer nofollow">reported</a> that the bridge lost more than $11.5 million after attackers used what security researchers described as a forged cross-chain transfer message.</p>
<p>PeckShield had reported that the drained assets included 103.6 tBTC, 1,625 ETH, and nearly 147,000 USDC. The attacker later swapped the stolen assets into 5,402 ETH, worth about $11.4 million at the time.</p>
<p>Blockaid linked the exploit to missing source-amount validation inside the bridge logic. The firm said the issue was not an ECDSA bypass, not a notary key compromise, and not a parser or hash-binding bug.</p>
<h2 class="wp-block-heading" id="strong-bridge-security-remains-under-pressure-strong"><strong>Bridge security remains under pressure</strong></h2>
<p>The Verus recovery comes during a busy period for cross-chain security incidents. Recent coverage <a href="https://crypto.news/mapo-crashes-to-record-lows-bridge-attack-overwhelms-circulating-supply/" rel="noopener noreferrer nofollow">said</a> MAPO fell 96% after attackers exploited the Butter Network bridge and minted a huge amount of unauthorized tokens.</p>
<p>Echo Protocol also <a href="https://crypto.news/echo-protocol-pauses-bridge-after-attacker-mints-76m-ebtc/" rel="noopener noreferrer nofollow">paused</a> cross-chain activity after an attacker minted about $76.7 million in unauthorized eBTC on Monad. On-chain investigators said the exploiter used fake eBTC as collateral before moving funds through Tornado Cash.</p>
<p>These cases show why bridge validation remains a core risk for DeFi. Bridges hold assets across chains, so weak checks can allow attackers to trigger transfers, mint tokens, or move reserves before teams can stop the flow.</p>
<p>Read more: <a href="https://crypto.news/ethereum-price-pressure-builds-as-retail-sentiment-weakens/" rel="noopener noreferrer nofollow"> Ethereum price pressure builds as retail sentiment weakens </a></p>

Verus bridge attacker sends back $8.5M, keeps bounty

Table of Contents

crypto.news

Other articles published on May 22, 2026

Join our free newsletter for daily crypto updates!