Ethereum

Balance

Balance Coin

DeFi

Verus

<p>The Verus Ethereum Bridge, a cross-chain solution connecting the VerusCoin blockchain with Ethereum, faced a significant security breach on Thursday. Attackers successfully drained approximately $7.54 million worth of various cryptocurrencies directly from the bridge’s reserves on the Ethereum network.<br><a href="https://x.com/blockaid_/status/2080143099561496896?s=20" rel="noopener noreferrer nofollow">Blockaid</a> was among the first to detect the incident and reported that the attacker exploited the bridge’s import path. This allowed them to trigger unbacked payouts on the Ethereum side without corresponding assets on the Verus network. The stolen funds include a mix of major assets: ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD. This latest breach adds to a growing list of high-profile incidents affecting <a href="https://cryip.co/balance-coin-crashes-99-after-915k-exploit-hits-42dao-protocol/" rel="noopener noreferrer nofollow">DeFi protocols and bridges</a> in recent weeks.<br></p><blockquote class="twitter-tweet"><p><img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f6a8.png" alt="🚨" class="wp-smiley" style="height: 1em; max-height: 1em;"> Blockaid detected a <a href="https://x.com/VerusCoin?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@VerusCoin</a> Ethereum Bridge exploit on Ethereum.<br> An attacker used the bridge import path to trigger unbacked Ethereum-side payouts, draining ~$7.54M in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves.<br> More details in <img src="https://s.w.org/images/core/emoji/17.0.2/72x72/1f9f5.png" alt="🧵" class="wp-smiley" style="height: 1em; max-height: 1em;"></p><p>— Blockaid (@blockaid_) <a href="https://x.com/blockaid_/status/2080143099561496896?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">July 23, 2026</a></p></blockquote><h2 id="verus-and-the-ethereum-bridge-background">Verus and the Ethereum Bridge Background</h2><p>VerusCoin (VRSC) is a blockchain project that began in 2018, focusing on privacy, decentralization, and multi-chain functionality. It uses a hybrid consensus mechanism (Proof of Power combining PoW and PoS) and supports features like zero-knowledge privacy and the ability to launch custom public blockchains (PBaaS).</p><p>The <strong>Verus-Ethereum Bridge</strong>, fully operational since October 2023, is promoted as a non-custodial, trustless bridge. It enables asset transfers and conversions between Verus and Ethereum using cryptographic proofs verified by Verus miners and stakers, without relying on centralized custodians. The bridge aims for transparent, consensus-proven accounting of funds.</p><h2 id="history-and-post-may-exploit">History and Post-May Exploit</h2><p>The bridge <a href="https://cryip.co/verus-ethereum-bridge-exploited-11-58-million-drained-in-major-security-breach/" rel="noopener noreferrer nofollow">suffered a major exploit in May 2026</a>, where approximately $11.58 million was drained using a similar vulnerability in the import path and validation logic. In that incident, a significant portion of funds (about 75%) was later returned by the exploiter. Following the May hack, the project and bridge operators reviewed the incident and were expected to strengthen validation checks between the Verus and Ethereum sides.</p><p>Despite these steps, the July exploit occurred on the same bridge contract using a similar import path and bug class. This shows that the underlying validation issue had not been fully resolved.</p><h2 id="exploit-details">Exploit Details</h2><ul><li>Bridge Contract: <a href="https://etherscan.io/address/0x71518580f36FeCEFfE0721F06bA4703218cD7F63" rel="noopener noreferrer nofollow">0x71518580f36FeCEFfE0721F06bA4703218cD7F63</a></li><li>Loot Wallet: <a href="https://etherscan.io/address/0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54" rel="noopener noreferrer nofollow">0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54</a></li><li>Attacker Address (as reported): <a href="https://etherscan.io/address/0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c" rel="noopener noreferrer nofollow">0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c</a></li></ul><p>The attacker called the submitImports function, leading to payouts from bridge reserves without matching Verus-side backing. The core issue was the same as in May, insufficient verification that input amounts on one side matched the payout amounts on the Ethereum side.</p><p>There are no confirmed reports of fund recovery at the time of writing. The incident once again draws attention to the challenges of securing cross-chain bridges, even in projects with strong decentralization principles. Similar pressures have been visible in other recent exploits, such as the <a href="https://cryip.co/secondfi-shuts-down-following-2-6-million-ada-security-breach/" rel="noopener noreferrer nofollow">shutdown of SecondFi</a> following a security breach and the sharp crash in Balance Coin after a protocol exploit. Users are advised to remain cautious with bridge interactions and monitor official Verus channels for any updates or patches.</p>

VerusCoin Ethereum Bridge Exploited for $7.54 Million in Repeat Attack

Table of Contents

CRYIP

Other articles published on Jul 23, 2026

What is BlackRock's BUIDL Fund on Avalanche AVAX?

Which Crypto Companies and Protocols Make The Most Money?

REAL Joins Blockchain for Europe to Shape EU Tokenisation Rules

Insights from CoinGecko's Q2 Crypto Report

Will Robinhood Chain Push ETH's Price to All Time Highs?

Grayscale Picks Its Most Promising Tokenization Blockchains

Join our free newsletter for daily crypto updates!