Verus-Ethereum Bridge Drained of $11.6M in May Exploit

Blockchain security firms Blockaid and PeckShield flagged an exploit on Monday that drained roughly $11.58 million from the Verus-Ethereum bridge. Security researchers identified the attacker’s externally owned account as 0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777.

PeckShield reported the attacker removed approximately 103.6 tBTC (a tokenized bitcoin on Ethereum), 1,625 ETH and 147,000 USDC from the bridge. On-chain tracing shows the stolen assets were swapped and consolidated into about 5,402.4 ETH, valued at roughly $11.4 million, and moved to wallet 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9. The total loss has been reported as $11.58 million.

Security postings noted the attacker’s address received an initial funding of 1 ETH via Tornado Cash about 14 hours before the withdrawals. Analysts and monitoring services advised users to watch activity tied to the bridge and the identified addresses while investigations continue.

There has been no public recovery of funds and Verus had not issued an official statement at the time of the alerts. The security firms have not released a formal postmortem and on-chain monitors continue to track the addresses for further movements.

The Verus incident occurred three days after a breach at THORChain that drained more than $10 million in protocol-owned funds and led to a pause in trading. THORChain posted that user balances were not affected and contributors are investigating the incident with THORSec and external partners.

Data from DeFiLlama shows 12 decentralized finance protocols had been hit in May before the Verus exploit, with combined losses exceeding $20 million for the month. April 2026 recorded more than $606 million in losses across 12 incidents, including a $292 million drain of the KelpDAO bridge.

Blockchain tracing tools continue to follow the flow of assets from the Verus bridge through several swaps into the destination wallet as investigators monitor for further activity.