The Verus-Ethereum bridge was exploited for $11.6 million.

The DeFi protocol Verus is being exploited targeting the Verus–Ethereum bridge, and approximately $11.58 million has been withdrawn so far, according to several blockchain security companies.

Blockaid warned of the attack on X, stating that the attacker's address was "0x5aBb…D5777", and the stolen assets were concentrated in the wallet "0x65C…C25F9".

PeckShield reported that the bridge had been withdrawn 103.6 tBTC, 1,625 ETH , and 147,000 USDC. The attacker then converted these assets into approximately 5,402 ETH, equivalent to about $11.4 million. PeckShield also stated that the attacker's wallet was initially "pumped" with 1 ETH via Tornado Cash about 14 hours prior – a common tactic to conceal the flow of funds.

Another entity, GoPlus, suggests that the attacker sent a small-value transaction to the bridge contract and then called a specific function to force the bridge to transfer a large amount of reserve assets to the "drainer" wallet. GoPlus believes this is most likely a problem related to cross-chain message authentication/forged signatures, withdrawal logic circumvention, or access control errors.

Verus stated on Discord that the Verus network had to shut down after most of the active Block -generating nodes were forced to shut down following a "side effect" of the attack (as per the design mechanism). The team said developers are investigating exactly how the attack was carried out and will decide on the next steps.

Verus is a privacy-focused blockchain protocol launched in 2018, using a "proof-of-power" consensus mechanism that combines proof-of-work and proof-of- Stake. The Verus– Ethereum bridge was deployed in October 2023, allowing the transfer and swapping of assets between the Verus and Ethereum networks.