Verus bridge hack drains $11.58M as attacker swaps stolen assets to ETH
May 20, 2026
Validation gap let attacker pull 103.6 tBTC, 1,625 ETH and 147K USDC, then route the haul through Tornado Cash.
Validation gap let attacker pull 103.6 tBTC, 1,625 ETH and 147K USDC, then route the haul through Tornado Cash.
Attacker exploited a missing source-amount check in checkCCEValues to swap $0.01 of inputs for $11.58M in ETH, USDC, and tBTC.