- The breach of the Verus-Ethereum cryptocurrency bridge led to an immediate loss of assets worth $11.58 million.
- The attacker exploited a flaw in the contract logic, then cashed out the stolen tokens and laundered them through the Tornado Cash mixer.
- The creators of the Verus protocol decided to emergency stop the network and turn off most of the nodes validating transactions.
Attacker EOA: 0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777 Drainer wallet (still holding the funds): 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9 Exploit tx: Bridge contract: https://t.co/EN3LkDfId9
Blockaid@blockaid_🔎 Verus-Ethereum Bridge $11.58M drain – Suspected root cause Same class as Wormhole-2022 / Nomad-2022: source ↔ destination economic-value binding gap. What the bridge correctly verifies: ✓ Notarized Verus state root (8/15 valid notary sigs, all cryptographically sound) ✓
What was the attack on the network bridge like?
The detailed course of the incident was revealed by the on-chain security platform Blockaid in its official report published on website X. Analysts identified the digital trace of the attacker and indicated the direct cryptographic address of the perpetrator: 0x5aBb…D5777. The stolen capital was originally transferred to the wallet with the reference number 0x65C…C25F9. The entire operation was prepared well in advance. The address associated with the hacker received initial funding for transaction fees (called gas) of 1 ETH approximately 14 hours before the impact. These funds came from the decentralized Tornado Cash mixer, which was intended to make it impossible to identify the perpetrator.
Peckshield provided accurate loss calculations. The bridge securing the transactions lost 103.6 tBTC, 1,625 ETH and 147,000 USDC. The aggressor immediately started liquidating the loot. He exchanged all seized tokens via decentralized exchanges for 5,402 ETH, whose market value at the time of conversion was approximately $11.4 million.
Exploited gap and drainage mechanism
Analyzes by GoPlus shed further light on the matter. The bridge’s security was breached using a specific interaction scheme with the smart contract. The attacker sent a transaction of negligible financial value to the network, but it contained malicious instructions. They triggered a hidden function in the code that forced the contract to perform a mass transfer of all accumulated reserves directly to the hacker’s address.
GoPlus experts point to three potential sources of failure: forgery of cross-chain message verification signatures, complete bypass of the withdrawal authorization logic, or a fundamental flaw in the administrator access control system.
Do you currently have cryptocurrencies?
It’s about cryptocurrencies on an exchange, in an application or in a wallet. Don’t treat cryptocurrency ETFs, ETNs and ETPs as ownership.
The survey is anonymous and voluntary. We do not collect your name or IP address. We only publish data in aggregate. Privacy Policy
Emergency blockage and response from Verus developers
The reaction of the project creators was immediate. A message appeared on the official Discord channel of the Verus team informing about the complete freezing of the ecosystem. Most of the nodes responsible for generating subsequent blocks and approving transactions were intentionally disabled by their operators. This happened automatically after network software detected anomalies as a direct side effect of the hacker attack.
Verus representatives stated that developers are currently investigating the exact mechanism of the code’s vulnerability to manipulation and are working on a repair procedure. The infrastructure blockade will last until the threat is fully removed.
Verus is a project developed since 2018, based on a hybrid consensus combining Proof-of-Work with Proof-of-Stake. The full connection to Ethereum launched in October 2023. This bridge was a key bus for users wishing to convert and transfer capital between the two independent networks. Currently, its operation remains completely suspended.
