Skip to main content
• 6 min read

Verus-Ethereum Bridge
Exploit: $7.54M Drained via Unbacked Imports

$7.54 million drained from the Verus-Ethereum Bridge after submitImports accepted an unbacked cross-chain payout, repeating May’s import-validation failure.

AUTOSEC.DEVAUTOSEC.DEV
Verus-Ethereum Bridge Exploit: $7.54M Drained via Unbacked Imports
  • Incident Date: July 23, 2026
  • Target: Verus-Ethereum Bridge
  • Target Overview: The Verus-Ethereum Bridge uses a source-chain export and Ethereum-side import model to move value between Verus and Ethereum. The affected Ethereum proxy contract held reserves used to settle validated cross-chain transfers.
  • Total Loss: ~$7,540,000
  • Attack Vector: Cross-chain message forgery / import-validation logic flaw / value-conservation failure

Incident Review & Technical Details​

1. Attack Path​

  1. A Low-Value Source-Side Export Anchored the Import: According to SIRENBOW's independent analysis, the attacker created an export worth approximately 0.01–0.02 VRSC on Verus while committing the hash of a much larger attacker-chosen payout list. This source-side step is reported rather than independently confirmed in an official Verus post-mortem.
  2. Valid State Attestation Did Not Prove Economic Backing: Verus notaries committed the source-chain state to Ethereum. The available evidence does not indicate that notary keys were compromised; the failure was that a valid state commitment could authenticate the payout-list hash without proving that equivalent value had been locked on Verus.
  3. The Attacker Called the Existing Import Path: At approximately 03:45 UTC, the initiator address 0xBda71b58cEc0b1C20A8f87cCD52FA0679747855c submitted transaction 0xa1f1e65c...24eb099 to bridge proxy 0x71518580...cD7F63. The call carried no ETH beyond gas and entered the bridge's submitImports path with a forged cross-chain import.
  4. Integrity Checks Passed Without a Value-Conservation Check: SIRENBOW's review of the verified implementation found that checkExportAndTransfers compared the transfer-list hash and source, destination, and currency identifiers. It did not independently enforce that the value paid on Ethereum was less than or equal to the value proven as reserved on Verus.
  5. Ethereum-Side Reserves Paid the Attacker-Chosen List: The bridge's payout logic released approximately 1,137 ETH plus 71.5045915 tBTC, 149,275.07 USDC, 78,300.54 USDT, 31,475.66 EURC, 59.43 MKR, and 92,784.36 scrvUSD. The assets landed in attacker-controlled loot wallet 0xCFd0A207...989C142D54, producing an estimated total loss of $7.54 million.
  6. The Proceeds Were Converted and Mixed: CertiK reported that the stolen basket was swapped into approximately 3,916.1 ETH. On-chain analysis subsequently traced fixed-denomination deposits from the attacker's fund flow into Tornado Cash.

2. Impact Scope​

  • Protocol-Level Loss: Approximately $7.54 million left the bridge's Ethereum-side reserves in a single primary exploit transaction.
  • Affected Assets: The drain covered seven reserve assets: ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD.
  • Repeat-Exploit Risk: Blockaid linked the July incident to the May 18 exploit through the same bridge contract, the same submitImports entry path, and the same vulnerability class. The July transaction used a different initiator and loot wallet.
  • Prior-Incident Context: The May attack caused a separate loss of approximately $11.58 million. Its attacker later returned 4,052.4 ETH and retained 1,350 ETH under a bounty-style settlement; those figures are not part of the July loss or recovery status.
  • Ecosystem Contagion: The reviewed sources did not report a compromise of Ethereum, Verus notary keys, a third-party bridge, or another protocol. The direct impact was concentrated in reserves controlled by the affected bridge contract.

3. Official Statements​

  • Blockaid: The security firm said the July attack triggered unbacked Ethereum-side payouts and shared the same contract, entry path, and bug class as the May incident, while using a different attacker transaction and loot wallet.
  • CertiK: CertiK's independent loss estimate was consistent with the approximately $7.54 million total, and the firm reported that the attacker converted the stolen assets into about 3,916.1 ETH before routing proceeds into Tornado Cash.
  • Verus: As of July 30, 2026, no public Verus statement or final technical post-mortem addressing the July 23 incident was located in the reviewed sources.

4. Investigation Progress​

The exploit transaction, bridge proxy, initiating EOA, loot wallet, implementation contracts, and subsequent Tornado Cash route are publicly traceable on Ethereum. However, no reviewed source reported that any July proceeds had been frozen, returned, or recovered as of July 30, 2026.

The central unresolved question is why the same import path remained capable of producing an unbacked payout after the May incident. Blockaid confirmed the shared vulnerability class, while SIRENBOW inferred from the verified code that the earlier patch may have constrained a specific forged-input path without adding the broader invariant destination payout <= provably reserved source value. Until Verus publishes its own code-level analysis, an incomplete patch, a regression, and a distinct path with the same economic effect should remain separate possibilities.

AUTOSEC.DEV Solution​

Preventing another bridge drain through this failure mode requires independent validation of both message integrity and economic value across the complete source-to-destination execution path.

  1. Secure Code Review — In the Verus-Ethereum Bridge path, a matching transfer-list hash and valid chain identifiers did not establish that $7.54 million of Ethereum-side payouts had equal source-side backing. AUTOSEC.DEV reviews bridge proof decoding, asset and amount binding, reserve accounting, nonce handling, and end-to-end value-conservation invariants, then converts each invariant into fuzz and fork-based regression tests.
  2. Red Team Assessment — The July attacker reached the same submitImports entry path used in May after bridge functionality had resumed. AUTOSEC.DEV recreates adversarial source-chain exports and destination-side imports—including tiny-source/high-payout cases, alternate payload encodings, replay conditions, and patch-bypass attempts—to test whether deployed controls fail under realistic attacker workflows.

Reference​