<\/p>\n
The Verus Protocol Ethereum bridge has suffered an exploit that has allowed an attacker to siphon off more than $11.5 million in crypto assets through what security researchers described as a forged cross-chain transfer message.<\/p>\n
<\/p>\n
According to onchain security platform Blockaid, the exploit<\/a> was detected late Sunday after its monitoring systems flagged suspicious activity tied to the Verus-Ethereum bridge. Blockaid identified the attacker wallet as \u201c0x5aBb\u2026D5777\u201d and said the stolen funds were initially moved into another address labeled \u201c0x65C\u2026C25F9.\u201d<\/p>\n Data shared by blockchain security firm PeckShield showed<\/a> that the drained assets included 103.6 tBTC, 1,625 ETH, and nearly 147,000 USDC. PeckShield later reported that the attacker swapped the stolen tokens into 5,402 ETH, valued at roughly $11.4 million based on current prices.<\/p>\n Hours before the exploit took place, PeckShield said the attacker\u2019s wallet had received 1 ETH through crypto mixer Tornado Cash, a detail that often appears in attacks involving attempts to obscure transaction origins.<\/p>\n Further analysis from GoPlus Security indicat<\/a>e<\/a>d<\/a> that the attacker first sent a low-value transaction to the bridge contract before invoking a function that caused reserve assets to be batch-transferred to the drainer wallet.<\/p>\n GoPlus said the exploit was \u201chighly likely\u201d tied to either cross-chain message validation failure, withdrawal logic bypass, or an access control weakness inside the bridge mechanism.<\/p>\n <\/p>\n Offering a more specific explanation, Blockaid later stated that the incident resembled the 2022 Nomad Bridge exploit and Wormhole exploit attacks, where fraudulent transfer instructions tricked protocols into releasing reserve funds.<\/p>\n In a follow-up technical assessment, Blockaid said the exploit was \u201cnot an ECDSA bypass,\u201d \u201cnot a notary key compromise,\u201d and \u201cnot a parser\/hash-binding bug.\u201d Instead, the firm attributed the issue to \u201ca missing source-amount validation in checkCCEValues,\u201d describing it as a flaw that could reportedly be fixed with around 10 lines of Solidity code.<\/p>\n