Verus–Ethereum Bridge Drained for $11.6M in Single Transfer, Challenging "NoCode" Security Pitch

A hacker siphoned about $11.58 million from the Verus–Ethereum bridge in a single outbound transaction on May 17, 2026, striking a cross-chain project that had promoted itself as resistant to smart-contract exploits. The activity was first spotted in real time by blockchain security firm Blockaid and later circulated by on-chain intelligence account @coinxtreme_en on X. On-chain data shows the receiving wallet, 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9, took one transfer comprising roughly 1,625 ETH (about $3.43 million), 103.57 tBTC (about $7.96 million), and 147,000 USDC (about $147,000). Traces indicate much of the haul was quickly swapped into ETH on Uniswap. Verus had marketed its bridge as relying on "protocol rules, not custom code," emphasizing cryptographic proofs, notary witnesses, and protocol-level validation rather than bespoke smart-contract logic. The breach highlights a key weakness for bridges: even designs aimed at minimizing exploitable code can still fail in implementation or operations. The sequence of events has also drawn scrutiny. Two days before the theft, Verus issued an emergency update (version 1.2.14-2) described as urgent and mandatory, citing an unspecified vulnerability. According to @coinxtreme_en, the attacker wallet received funds via Tornado Cash about 11–13 hours after the announcement, a pattern consistent with an actor positioning infrastructure around the update window. Cross-chain bridges remain one of DeFi's most targeted components and have accounted for an outsized share of sector losses since 2021. The Verus incident reinforces calls for stronger formal verification, independent audits, and operational safeguards such as pausing or restricting functionality when credible threats emerge. In markets, Ethereum extended its recent weakness, down about 10% over the past week and roughly 3% over the last 24 hours at the time of writing. Cover image: generated by ChatGPT. ETHUSD chart from TradingView.