VerusEthereum Bridge Exploited Again, $7.54M Drained in Repeat-Style Attack

The VerusEthereum Bridge has suffered a second major exploit in roughly two months, with about $7.54 million siphoned in an attack that appears to mirror May's breach. Blockchain security firm Blockaid said it detected the latest incident on July 23. The firm reported that the attacker abused the bridge's import process to unlock funds on Ethereum without posting matching assets on the source chain. On-chain data places the exploit at 03:45 UTC. Funds sent to an attacker-controlled wallet included around 1,137 Ethereum (ETH) as well as tBTC, USD Coin (USDC), Tether (USDT), EURC, Maker (MKR), and Savings crvUSD (scrvUSD). Etherscan valued the primary outflows at approximately $7.54 million at the time. Blockaid noted that while the attacker used a different wallet and transaction, the same bridge contract and entry path were targeted, pointing to a similar bug category to the May exploit. Blockaid traced the latest proceeds to 0xCFd0…2D54, saying the attacker again manipulated the import process to trigger payouts on Ethereum without equivalent backing. In May, an attacker reportedly bypassed a validation check via a forged cross-chain import, draining about $11.58 million. After Verus offered settlement terms, the attacker returned 4,052.4 ETH (then worth about $8.5 million) and kept 1,350 ETH as a bounty. Investigators believe both incidents involve the same contract, access route, and flaw type, though a full technical explanation has not yet been released. The Verus case came amid other reported bridge-related losses. On-chain tracker Lookonchain estimated that attacks affecting AFX Trade, Verus, and BSquared Network totaled about $35.55 million in losses. AFX Trade accounted for the largest hit at roughly $24.15 million in USDC, which was moved to Ethereum and swapped for 12,467 ETH. Lookonchain said Arbitrum's native bridge was not affected, as the issue originated from infrastructure managed by a third-party protocol. BSquared Network was also reported to have lost about $3.86 million. Final Summary: VerusEthereum Bridge lost around $7.54 million in a second major exploit within two months. The incident closely resembles May's $11.58 million breach, with the root cause still under investigation.