Verus Bridge Suffers Second Exploit in 66 Days as Flaw Pushes Total Losses to $19.1M
On July 23, the Verus-Ethereum Bridge smart contract was exploited, resulting in the theft of approximately $7.3 million to $7.5 million in various digital assets, according to blockchain security researchers. This marks the second breach of the same contract within 66 days, following an attack on May 17 that stole around $11.6 million using a similar method, bringing total losses to approximately $19.1 million.
The attack involved a maliciously crafted import from the Verus side that included an unbacked payout request on Ethereum. Security analysts noted that the bridge verified notary signatures, state roots, and Merkle proofs but failed to verify that the requested payout amount matched the assets locked or exported on the Verus side. Backward Labs identified the root cause as an authorization bypass and protocol-state assumption issue. The bridge accepted a proven import authorizing multi-asset reserve payouts, but critical upstream checks for creation, authorization, transfer hash, count, and economic backing were insufficient. One analysis noted: “This time, the same root cause remained exploitable for 66 days.”
Assets drained from the bridge’s reserves included Ether, tBTC, MKR, USDC, Tether, EURC, and scrvUSD. For DAI, the bridge interacted with a Sky (formerly MakerDAO) collateral position to mint roughly 220,357 DAI to fulfill the fraudulent request. Monitoring tools flagged the transaction with a critical score, citing state manipulation, arbitrary minting, and DeFi outflows.
Backward Labs published a report and proof-of-concept highlighting the broken invariant: “Ethereum bridge reserves may be released only for source-chain reserve transfers whose CCE creation, authorization, transfer hash, count, and economic backing are all proven under the expected bridge lifecycle.”
This exploit highlights ongoing security challenges with cross-chain bridges, where cryptographic verification succeeds but business-logic validation for asset backing fails. Bridge exploits remain a recurring issue in DeFi, often leading to unrecoverable losses because blockchain transactions are immutable.