Verus Ethereum Bridge Hit Again with $7.54M Drained via Same Entry Path

The Verus Ethereum Bridge was exploited again on July 23, with attackers draining roughly $7.54 million from the same bridge contract that was hit in May. What happened - Blockchain security firm Blockaid flagged the attack on Ethereum at 03:45 UTC on July 23. Onchain records show a transaction interacting with the Verus bridge contract that moved about 1,137 ETH plus multiple tokens (tBTC, USDC, USDT, EURC, MKR and scrvUSD) to an attacker-controlled address. Etherscan valued the outflows at about $7.54 million at the time. - Target bridge contract: 0x71518580f36feceffe0721f06ba4703218cd7f63 - Attacker wallet that received the funds: 0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54 (short: 0xCFd0…2D54) - Exploit transaction (reported): https://t.co/XPN25gbZp4 How the attacker operated Blockaid says the attacker abused the bridge’s import path to trigger Ethereum-side payouts that were not backed by matching assets on the source chain. While the July drain involved a different transaction and attacker-controlled wallet than the May incident, Blockaid described both incidents as involving “the same bridge contract, same entry path, and same bug class.” A full technical report on the July attack had not been published at the time of the alert, and the exact root cause remained under investigation. Background and prior incident This is the second major hit to the Verus bridge in recent months. In May, the Verus Ethereum Bridge lost roughly $11.58 million after a validation gap allegedly allowed a forged cross-chain import to pass verification, releasing more funds on Ethereum than were committed on the source chain. After that exploit, the attacker returned 4,052.4 ETH (about $8.5 million at the time) under settlement terms, keeping 1,350 ETH as a bounty — roughly 75% of the exploiter’s ETH holdings after conversion. Wider context The July Verus exploit was one of several bridge-related incidents reported within hours. On the same day, AFX Trade suffered an estimated $24.15 million loss and B² Network about $3.86 million, leaving combined reported losses of roughly $35.55 million across the three events, according to onchain tracker Lookonchain. The AFX incident involved USDC taken from infrastructure operated by a third-party protocol and later converted into ETH. Why this matters Cross-chain bridges must validate events and values across separate blockchains while controlling shared reserves. Mistakes in message validation, contract logic or access controls can allow an on-chain payout to go out without a corresponding deposit on the source chain. Blockaid says the July exploit “appears related to the previous Verus Ethereum Bridge incident in May 2026,” but has not confirmed whether the same vulnerability was reused or whether a new path through the import process was exploited. What’s next At the time of reporting, sources confirmed that funds left the Verus bridge for the new attacker wallet but did not indicate whether any assets had been frozen, returned or recovered, nor did they provide a remediation timeline. Further technical analysis will be needed to determine whether the May flaw remained exploitable or if a distinct weakness was used this time — and to track whether the stolen funds are converted or laundered through other services. This is a developing story; we’ll update as Blockaid or Verus release more technical details or recovery actions.