Verus bridge hack drains $11.58M as attacker swaps stolen assets to ETH
May 20, 2026
Validation gap let attacker pull 103.6 tBTC, 1,625 ETH and 147K USDC, then route the haul through Tornado Cash.
Validation gap let attacker pull 103.6 tBTC, 1,625 ETH and 147K USDC, then route the haul through Tornado Cash.
Attacker exploited a missing source-amount check in checkCCEValues to swap $0.01 of inputs for $11.58M in ETH, USDC, and tBTC.
Admin key compromise let an attacker mint 1,000 synthetic Bitcoin on Echo’s Monad bridge and cash out $821K through Tornado Cash.
RUNE fell 12% after attackers drained funds across Bitcoin, Ethereum, BNB Chain, and Base on May 15
Attacker drained funds across Bitcoin, Ethereum, BSC, and Base, RUNE token fell 12%
DeFi TVL drops 3B and Aave faces 30M in bad debt as fallout from 2026’s biggest crypto hack spreads
LayerZero attributes the exploit to Lazarus Group and bans single-verifier projects from its network
A single-verifier flaw in Kelp’s LayerZero bridge let attackers drain 116,500 rsETH and saddle Aave with $196M in bad debt.
Single-verifier bridge config let North Korea drain DeFi’s biggest 2026 exploit