New Verus-Ethereum bridge attack drains $7.5 million through flaw used in May: Blockaid

Verus-Ethereum Bridge has suffered a second exploit in just about two months after an attacker drained roughly $7.54 million in crypto assets on Wednesday by exploiting the same vulnerability class used in the protocol's May breach, according to blockchain security firm Blockaid.

In a post on X, Blockaid said the attacker abused the bridge's import path to trigger unbacked Ethereum-side payouts, draining ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves before converting the stolen assets into ETH.

Blockchain security firm CertiK also flagged the exploit, estimating losses at approximately $7.53 million. The firm said the attacker withdrew the funds through the Verus-Ethereum bridge, later swapped the stolen assets for 3,916.1 ETH and deposited the proceeds into Tornado Cash.

Meanwhile, Blockaid said the latest exploit appears related to the Verus-Ethereum bridge attack disclosed in May, citing the same bridge contract, entry path and vulnerability class, while noting the transaction was carried out by a different attacker using a new loot wallet.

The previous exploit on May 18 drained roughly $11.6 million from the bridge after the attacker converted the stolen assets into about 5,402 ETH. The attacker later returned 4,052 ETH after retaining a 25% white-hat bounty.

The Block has reached out to the Verus team for comment on the latest attack.