Another attack on the Verus Ethereum Bridge occurred, with an attacker stealing about $7.54 Million in assets.
You can read more about it here:
- Verus Ethereum bridge lost $7.54m in a recent exploit that targeted the import path.
- Blockaid said the attack was similar to May’s exploit. The root cause is still under investigation.
- According to Lookonchain, three crypto-exploits reported on Thursday resulted in combined losses of approximately $35.55 Million.
Blockaid, a Blockchain-based security firm detected The attacker claimed responsibility for the attack that occurred on Ethereum, July 23, and used the import path of the bridge to generate payouts which were not supported by assets from the source.
Blockaid reported that the attack involved a transaction with a wallet under attacker control, which was different from what happened in May. According to Blockaid, the attackers used the same entry point and bridge contract as well as the apparent bug class in the latest attack. When the alert was released, however, it was not known what the root cause exactly is.
Verus bridge exploit drains multiple assets
Onchain’s records reveal that at 0345 UTC, the exploited transaction interacted the Verus Ethereum contract. This transaction sent about 1,137 Ethereum and several tokens from an attacker’s address. Assets included tBTC USDC USDT EURC MKR scrvUSD Etherscan estimated the bridge’s main outflows to be around $7.54million at that time.
Blockaid claimed that the attacker used the bridge import to generate unbacked Ethereum-side payments. The firm identified the receiving address as 0xCFd0…2D54 and linked the withdrawal to the same bridge contract involved in the earlier Verus incident. The firm hasn’t yet released a full technical report about the latest transaction.
Moreover, this latest exploit occurs just two months following a separate attack that cost Verus Ethereum Bridge approximately $11,58,000,000. Security researchers say the attacker used a validation hole to allow a forgery of a cross-chain export that was not verified on Ethereum.
Blockaid has said that the attack on July was a blockaid “appears related to the previous Verus Ethereum Bridge incident in May 2026.” He also said that the incidents involved the “same bridge contract, same entry path, and same bug class,” Although a technical explanation for this latest exploit is not yet available.
Crypto.news reported After the Verus project proposed settlement terms, in May the first attacker returned to the bridge 4,052.4 ETH. This was worth approximately $8.5 Million at that time. As a reward, the attacker retained 1,350 ETH. This amount represents about 75% the money held by the attacker after converting the assets into ETH.
Within hours, three exploits were reported.
Verus’ attack was part of an extensive series of incidents that were reported in a matter of hours. Onchain tracker Lookonchain said AFX Trade, Verus and B² Network had suffered exploits with combined reported losses of about $35.55 million. The figures included $24.15 million from AFX, about $7.55 million from Verus and roughly $3.86 million from B² Network.
Earlier today an AFX bridge operated by a sysadmin was attacked. lost $24.15 million in USDC The attacker converted the 12 467 Ethereum into the money before transferring the funds. Offchain Labs confirmed that this incident didn’t affect Arbitrum bridges and was caused by infrastructure of a third party protocol.
The incident adds to the ongoing scrutiny of inter-chain systems. Recent findings from a recent crypto.news explainer It should be noted that the bridges need to verify transactions across different blockchains, while also controlling assets in reserves shared. A transaction can release assets if there are errors in the message validation or contract logic.
The details of root causes and recovery are still pending
Blockaid stated that Verus’s new exploit appeared to have the same weakness as the one seen in May. But it stopped short of saying the vulnerability was the cause of the drain. Security analyses claim that the May attack resulted from a lack of verification between the amounts committed to the Ethereum chain on the source and on Ethereum.
The most recent transaction confirms funds have left Verus for the attacker’s wallet. However, the sources reviewed failed to confirm whether assets were frozen, recovered or returned. The sources did not offer a plan for remediation or an estimated timeline to make changes in bridge operations.
Technical details may reveal whether or not the flaw from May was still exploitable. They could also indicate whether an unrelated weakness is responsible for the incident. Or, if the attacker took a different route using the same process of import. It is also possible to determine if the assets stolen are then converted into other forms of currency or transferred through another service by observing how funds move in future.
This case is still a story in progress.
“This article is not financial advice.”
“Always do your own research before making any type of investment.”
“ItsDailyCrypto is not responsible for any activities you perform outside ItsDailyCrypto.”
Source: crypto.news
