Verus Ethereum bridge drained of $11.5M in forged transfer exploit

cryptonews15:07

The Verus Protocol Ethereum bridge has suffered an exploit that has allowed an attacker to siphon off more than $11.5 million in crypto assets through what security researchers described as a forged ...

Source Link

Disclaimer: Investing carries risk. This is not financial advice. The above content should not be regarded as an offer, recommendation, or solicitation on acquiring or disposing of any financial products, any associated discussions, comments, or posts by author or other users should not be considered as such either. It is solely for general information purpose only, which does not consider your own investment objectives, financial situations or needs. TTM assumes no responsibility or warranty for the accuracy and completeness of the information, investors should do their own research and may seek professional advice before investing.

Comments

We need your insight to fill this gap

Leave a comment

{"i18n":{"language":"en_US"},"isChannel":false,"data":{"share":"https://ttm.financial/m/news/2636047732?lang=en_US&edition=fundamental","thumbnail":"","is_english":true,"pubTime":"2026-05-18 15:07","share_image_url":"https://static.laohu8.com/e9f99090a1c2ed51c021029395664489","id":"2636047732","market":"sg","top_or_hot":-1,"title":"Verus Ethereum bridge drained of $11.5M in forged transfer exploit","media":"cryptonews","content":"<div>\n<p>The Verus Protocol Ethereum bridge has suffered an exploit that has allowed an attacker to siphon off more than $11.5 million in crypto assets through what security researchers described as a forged ...</p>\n\n<a href=\"https://crypto.news/verus-ethereum-bridge-drained-of-11-5m-in-forged-transfer-exploit/\">Source Link</a>\n\n</div>\n","source":"crypto_news_highlight","html":"<!DOCTYPE html>\n<html>\n<head>\n<meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\" />\n<meta name=\"viewport\" content=\"width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no\"/>\n<meta name=\"format-detection\" content=\"telephone=no,email=no,address=no\" />\n<title>Verus Ethereum bridge drained of $11.5M in forged transfer exploit</title>\n<style type=\"text/css\">\na,abbr,acronym,address,applet,article,aside,audio,b,big,blockquote,body,canvas,caption,center,cite,code,dd,del,details,dfn,div,dl,dt,\nem,embed,fieldset,figcaption,figure,footer,form,h1,h2,h3,h4,h5,h6,header,hgroup,html,i,iframe,img,ins,kbd,label,legend,li,mark,menu,nav,\nobject,ol,output,p,pre,q,ruby,s,samp,section,small,span,strike,strong,sub,summary,sup,table,tbody,td,tfoot,th,thead,time,tr,tt,u,ul,var,video{ font:inherit;margin:0;padding:0;vertical-align:baseline;border:0 }\nbody{ font-size:16px; line-height:1.5; color:#999; background:transparent; }\n.wrapper{ overflow:hidden;word-break:break-all;padding:10px; }\nh1,h2{ font-weight:normal; line-height:1.35; margin-bottom:.6em; }\nh3,h4,h5,h6{ line-height:1.35; margin-bottom:1em; }\nh1{ font-size:24px; }\nh2{ font-size:20px; }\nh3{ font-size:18px; }\nh4{ font-size:16px; }\nh5{ font-size:14px; }\nh6{ font-size:12px; }\np,ul,ol,blockquote,dl,table{ margin:1.2em 0; }\nul,ol{ margin-left:2em; }\nul{ list-style:disc; }\nol{ list-style:decimal; }\nli,li p{ margin:10px 0;}\nimg{ max-width:100%;display:block;margin:0 auto 1em; }\nblockquote{ color:#B5B2B1; border-left:3px solid #aaa; padding:1em; }\nstrong,b{font-weight:bold;}\nem,i{font-style:italic;}\ntable{ width:100%;border-collapse:collapse;border-spacing:1px;margin:1em 0;font-size:.9em; }\nth,td{ padding:5px;text-align:left;border:1px solid #aaa; }\nth{ font-weight:bold;background:#5d5d5d; }\n.symbol-link{font-weight:bold;}\n/* header{ border-bottom:1px solid #494756; } */\n.title{ margin:0 0 8px;line-height:1.3;color:#ddd; }\n.meta {color:#5e5c6d;font-size:13px;margin:0 0 .5em; }\na{text-decoration:none; color:#2a4b87;}\n.meta .head { display: inline-block; overflow: hidden}\n.head .h-thumb { width: 30px; height: 30px; margin: 0; padding: 0; border-radius: 50%; float: left;}\n.head .h-content { margin: 0; padding: 0 0 0 9px; float: left;}\n.head .h-name {font-size: 13px; color: #eee; margin: 0;}\n.head .h-time {font-size: 11px; color: #7E829C; margin: 0;line-height: 11px;}\n.small {font-size: 12.5px; display: inline-block; transform: scale(0.9); -webkit-transform: scale(0.9); transform-origin: left; -webkit-transform-origin: left;}\n.smaller {font-size: 12.5px; display: inline-block; transform: scale(0.8); -webkit-transform: scale(0.8); transform-origin: left; -webkit-transform-origin: left;}\n.bt-text {font-size: 12px;margin: 1.5em 0 0 0}\n.bt-text p {margin: 0}\n</style>\n</head>\n<body>\n<div class=\"wrapper\">\n<header>\n<h2 class=\"title\">\nVerus Ethereum bridge drained of $11.5M in forged transfer exploit\n</h2>\n\n<h4 class=\"meta\">\n\n\n2026-05-18 15:07 GMT+8&nbsp;&nbsp;&nbsp;<a href=https://crypto.news/verus-ethereum-bridge-drained-of-11-5m-in-forged-transfer-exploit/><strong>cryptonews</strong></a>\n\n\n</h4>\n\n</header>\n<article>\n<div>\n<p>The Verus Protocol Ethereum bridge has suffered an exploit that has allowed an attacker to siphon off more than $11.5 million in crypto assets through what security researchers described as a forged ...</p>\n\n<a href=\"https://crypto.news/verus-ethereum-bridge-drained-of-11-5m-in-forged-transfer-exploit/\">Source Link</a>\n\n</div>\n\n\n</article>\n</div>\n</body>\n</html>\n","isBrief":false,"type":0,"news_type":1,"symbol":"ESK","symbol_name":"REX-Osprey ETH + Staking ETF","start_time":0,"source_url":"https://crypto.news/verus-ethereum-bridge-drained-of-11-5m-in-forged-transfer-exploit/","article_id":"2636047732","we_media_id":null,"thumbnails":[],"rights":{"source":"crypto_news_highlight","url":"https://crypto.news/verus-ethereum-bridge-drained-of-11-5m-in-forged-transfer-exploit/","rn_cache_url":null,"directOrigin":true},"url":"https://stock-news.laohu8.com/highlight/detail?id=2636047732","pubTimestamp":1779088050,"columns":[],"sourceInfo":{"source_id":"crypto_news_highlight","name":"Crypto News"},"weMediaInfo":null,"summary":"The Verus Protocol Ethereum bridge has suffered an exploit that has allowed an attacker to siphon off more than $11.5 million in crypto assets through what security researchers described as a forged cross-chain transfer message.Verus Protocol’s Ethereum bridge lost more than $11.5 million after attackers reportedly used a forged cross chain transfer message.Blockchain security firms Blockaid, PeckShield, and ExVul linked the exploit to missing validation checks inside the bridge verification process.According to onchain security platform Blockaid, the exploit was detected late Sunday after its monitoring systems flagged suspicious activity tied to the Verus-Ethereum bridge. Blockaid identified the attacker wallet as “0x5aBb…D5777” and said the stolen funds were initially moved into another address labeled “0x65C…C25F9.”ExVul added that cross-chain proof systems should directly tie transfer execution to authenticated payload data before funds are released. The firm also recommended stri","collect":0,"end_time":0,"defaultTopTitle":"crypto.news","property":[],"viewcount":null,"language":"en","relate_stocks":{"ESK":"REX-Osprey ETH + Staking ETF","CBOY":"Calamos Bitcoin Structured Alt Protection ETF - July","BTCO":"比特币ETF-Invesco Galaxy","CBXO":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - October","ETCO":"Grayscale Ethereum Covered Call ETF","ETHI":"Defiance Leveraged Long Income Ethereum ETF","ETQ":"T-Rex 2X Inverse Ether Daily Target ETF","ARKB":"比特币ETF-21Shares","CBXY":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - July","QBF":"Innovator Uncapped Bitcoin 20 Floor ETF - Quarterly","IBIT":"比特币ETF-iShares","BTRN":"比特币期货ETF-Global X","FBTC":"比特币ETF-Fidelity","EZBC":"比特币ETF-Franklin","BITU":"2倍做多比特币期货ETF-Proshares","MAXI":"比特币期货ETF-Simplify","BTCW":"比特币ETF-Wisdom Tree","CBTA":"Calamos Bitcoin 80 Series Structured Alt Protection ETF – April","BTCZ":"T-Rex 2X Inverse Bitcoin Daily Target ETF","XBTY":"GraniteShares YieldBOOST Bitcoin ETF","DFII":"FT Cboe Vest Bitcoin Strategy & Target Income ETF","BFAP":"FT Vest Bitcoin Strategy Floor15 ETF - April","MNRS":"GRAYSCALE BITCOIN MINERS ETF","CBTJ":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - January","CBOA":"Calamos Bitcoin Structured Alt Protection ETF - April","BITX":"2倍比特币期货ETF-Volatility Shares","DEFI":"比特币期货ETF-Hashdex","CBOJ":"Calamos Bitcoin Structured Alt Protection ETF - January","BITY":"Amplify Bitcoin 2% Monthly Option Income ETF","TETH":"21Shares Ethereum ETF","SETH":"1倍做空以太币期货ETF-Proshares","BITB":"比特币ETF-Bitwise","BK4601":"加密货币现货ETF","CBTO":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - October","BCCC":"Global X Bitcoin Covered Call ETF","GBTC":"比特币ETF-Grayscale","BTC":"Grayscale Bitcoin Mini Trust","CBTY":"Calamos Bitcoin 80 Series Structured Alt Protection ETF - July","BTFX":"比特币期货ETF-CoinShares","BITI":"1倍做空比特币期货ETF-Proshares","HODL":"比特币ETF-VanEck","CBOO":"Calamos Bitcoin Structured Alt Protection ETF - October","BTCC":"Grayscale Bitcoin Covered Call ETF","BRRR":"比特币ETF-CoinShares","CBXA":"Calamos Bitcoin 90 Series Structured Alt Protection ETF – April","CBXJ":"Calamos Bitcoin 90 Series Structured Alt Protection ETF - January","BTCI":"NEOS Bitcoin High Income ETF","SBIT":"2倍做空比特币期货ETF-Proshares","BAGY":"Amplify Bitcoin Max Income Covered Call ETF","BPI":"Grayscale Bitcoin Premium Income ETF","BITO":"比特币期货ETF-ProShares","YBTC":"比特币看涨期权ETF-Roundhill","BFJL":"FT Vest Bitcoin Strategy Floor15 ETF - July","BTCL":"T-REX 2X LONG BITCOIN DAILY TARGET ETF"},"translate_title":"Verus以太币大桥因伪造转账漏洞损失1150万美元","themeId":null,"isJumpTheme":false,"ttsUrl":null,"symbols_score_info":{"BTFX":0.6,"CBTY":0.6,"CBOJ":0.6,"DEFI":0.6,"BITI":0.6,"TETH":0.6,"BCCC":0.6,"BTCO":0.6,"ETHI":0.6,"BTCC":0.6,"BPI":0.6,"BFJL":0.6,"CBTO":0.6,"HODL":0.6,"MAXI":0.6,"QBF":0.6,"CBTA":0.6,"BTC":0.6,"BRRR":0.6,"BITO":0.6,"IBIT":0.6,"BTCL":0.6,"XBTY":0.6,"CBTJ":0.6,"BTRN":0.6,"FBTC":0.6,"BTCW":0.6,"CBXJ":0.6,"DFII":0.6,"ETCO":0.6,"EZBC":0.6,"ETQ":0.6,"YBTC":0.6,"BFAP":0.6,"BITU":0.6,"CBXO":0.6,"BTCI":0.6,"MNRS":0.6,"ESK":0.6,"GBTC":0.6,"ARKB":0.6,"CBXY":0.6,"CBOA":0.6,"SBIT":0.6,"SETH":0.6,"CBOY":0.6,"CBXA":0.6,"BTCZ":0.6,"CBOO":0.6,"BITY":0.6,"BAGY":0.6,"BITX":0.6,"BITB":0.6},"content_text":"The Verus Protocol Ethereum bridge has suffered an exploit that has allowed an attacker to siphon off more than $11.5 million in crypto assets through what security researchers described as a forged cross-chain transfer message.\n\n\nSummary\n\n\n\nVerus Protocol’s Ethereum bridge lost more than $11.5 million after attackers reportedly used a forged cross chain transfer message.\nBlockchain security firms Blockaid, PeckShield, and ExVul linked the exploit to missing validation checks inside the bridge verification process.\n\n\n\nAccording to onchain security platform Blockaid, the exploit was detected late Sunday after its monitoring systems flagged suspicious activity tied to the Verus-Ethereum bridge. Blockaid identified the attacker wallet as “0x5aBb…D5777” and said the stolen funds were initially moved into another address labeled “0x65C…C25F9.”\nData shared by blockchain security firm PeckShield showed that the drained assets included 103.6 tBTC, 1,625 ETH, and nearly 147,000 USDC. PeckShield later reported that the attacker swapped the stolen tokens into 5,402 ETH, valued at roughly $11.4 million based on current prices.\nHours before the exploit took place, PeckShield said the attacker’s wallet had received 1 ETH through crypto mixer Tornado Cash, a detail that often appears in attacks involving attempts to obscure transaction origins.\nFurther analysis from GoPlus Security indicated that the attacker first sent a low-value transaction to the bridge contract before invoking a function that caused reserve assets to be batch-transferred to the drainer wallet.\nGoPlus said the exploit was “highly likely” tied to either cross-chain message validation failure, withdrawal logic bypass, or an access control weakness inside the bridge mechanism.\nOffering a more specific explanation, Blockaid later stated that the incident resembled the 2022 Nomad Bridge exploit and Wormhole exploit attacks, where fraudulent transfer instructions tricked protocols into releasing reserve funds.\nIn a follow-up technical assessment, Blockaid said the exploit was “not an ECDSA bypass,” “not a notary key compromise,” and “not a parser/hash-binding bug.” Instead, the firm attributed the issue to “a missing source-amount validation in checkCCEValues,” describing it as a flaw that could reportedly be fixed with around 10 lines of Solidity code.\nBlockchain security provider ExVul reached a similar conclusion, saying the attacker used a “forged cross-chain import payload” that successfully passed the bridge’s verification process. According to ExVul, the exploit eventually triggered three separate transfers from the bridge reserves into the attacker-controlled wallet.\nExVul added that cross-chain proof systems should directly tie transfer execution to authenticated payload data before funds are released. The firm also recommended stricter payload validation, layered verification protections, and emergency pause mechanisms for unusual outbound transfers.\nBridge exploits continue to hit DeFi sector\nLaunched in 2023, the Verus-Ethereum bridge allows users to move and convert assets between the Verus network and Ethereum. The protocol itself was introduced in 2018 and operates using a hybrid proof-of-work and proof-of-stake consensus model.\nAs of publication, the Verus team had not publicly commented on the exploit.\nThe incident has arrived during a year already hit by multiple major decentralized finance breaches. According to security tracking data cited in the additional reports, crypto hackers stole more than $168.6 million from 34 DeFi protocols during the first quarter of 2026 alone.\nApril accounted for two of the largest attacks recorded this year, including the reported $280 million Drift Protocol exploit and the $292 million Kelp exploit.\nOver the weekend, cross-chain liquidity protocol THORChain also confirmed suffering a separate $10 million exploit, adding to mounting concerns surrounding bridge and interoperability infrastructure across the DeFi sector.\n\n\n\n\n\n                Read more:\n            \n\n                NYDIG warns Senate crypto bill could stall after midterms","kind":"highlight","is_publish_news":true,"is_publish_highlight":false,"is_publish_live":false,"is_publish_wemedia":null,"editions":null,"column":"","sentiment":"0","news_tag":"","news_rank":0,"isVideo":false,"video":null,"symbols":[],"gpt_button":0,"need_auth":false,"need_login_tip":false,"code":"91000000","status":"200"},"commentList":[],"isCommentEnd":true,"newsSizeData":{"likeSize":0,"commentSize":0,"repostSize":0,"favoriteSize":0,"likeStatus":false,"favoriteStatus":false},"APP":{"userAgent":"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)","isDev":false,"isTTM":true,"tenantId":"TBGLOBAL","deviceId":"web-server-community-laohu8-v3","version":"4.42.2","shortVersion":"4.42.2","platform":"web","vendor":"web","appName":"ttm","isIOS":false,"isAndroid":false,"isTiger":false,"isTHS":false,"isWeiXin":false,"isWeiXinMini":false,"isWeiBo":false,"isQQ":false,"isBaiduSwan":false,"isBaiduBox":false,"isDingTalk":false,"isToutiao":false,"isOnePlus":false,"isHuaWei":false,"isXiaomi":false,"isXiaomiWebView":false,"isOppo":false,"isVivo":false,"isSamsung":false,"isMobile":false},"href":"/m/news/2636047732","isCrawlerRequest":true}