The Verus-Ethereum bridge hack drained roughly $11.58 million in user funds on May 18, 2026, after an attacker exploited a validation gap that allowed payouts on Ethereum without matching deposits on Verus. The thief made off with 103.6 tBTC, 1,625 ETH, and 147,000 USDC, then swapped the haul into about 5,402 ETH within minutes. Security firm Blockaid flagged the active exploit in real time and tied the attacker’s wallet to a Tornado Cash deposit made roughly 14 hours before the drain. The breach pushes May’s running tally of bridge losses to $328.6 million across eight separate incidents, according to PeckShield.
A cross-chain bridge is a piece of infrastructure that locks tokens on one blockchain and mints or releases a matching amount on another, allowing assets to move between networks that cannot natively talk to each other.
Key takeaways
- Attacker drained $11.58 million from the Verus-Ethereum bridge on May 18, 2026, per Blockaid and The Block.
- Stolen assets, including 103.6 tBTC and 1,625 ETH, were swapped into roughly 5,402 ETH.
- Root cause: the bridge validated state roots and transaction hashes but never confirmed that input and payout amounts matched.
- Bridge exploits now make up about 41% of all tracked DeFi losses in 2026, according to industry trackers.
Published: May 20, 2026, 16:00 UTC
What happened on the Verus bridge
The exploit unfolded on Monday, May 18, when on-chain monitors detected an abnormal outflow from the Verus-Ethereum bridge contract. According to The Block, the attacker pulled 103.6 tBTC, the Threshold Network’s tokenized bitcoin, alongside 1,625 ETH and 147,000 USDC. Within minutes the assets were routed through decentralized exchanges and converted into ether, leaving the protocol’s liquidity pools nearly empty.
Halborn’s post-incident analysis describes the vulnerability as a validation gap rather than a smart contract bug. The bridge confirmed state roots and transaction hashes between the two chains, but it never required the payout contract on Ethereum to check that the redeemed amount matched the locked amount on Verus. Blockaid researchers said a roughly ten-line Solidity check on transaction values would have prevented the drain.
Why the Tornado Cash trail matters
Several security firms, including PeckShield and Blockaid, traced the attacker’s funding wallet back to a 1 ETH withdrawal from Tornado Cash made about 14 hours before the exploit. The mixer link is significant for two reasons. First, it suggests deliberate planning rather than an opportunistic strike. Second, it brings the incident squarely into the cross-hairs of US sanctions enforcement, since Tornado Cash remains on the Treasury’s OFAC list following the May 2022 designation. Centralized exchanges receiving the laundered ether could face compliance exposure if they fail to block deposits tied to the wallet.
Impact on DeFi and cross-chain users
The Verus loss arrives during the worst stretch for bridge security in over a year. PeckShield has tracked eight separate bridge exploits in the first half of May 2026, with combined losses of $328.6 million. CertiK has labeled the recent surge a “high-stakes shift” in cross-chain attack tactics, with attackers focusing on lightly audited bridges that hold concentrated pools of wrapped assets.
For users, the immediate exposure is direct: anyone holding tBTC, wrapped ETH, or USDC on the Verus side of the bridge now faces uncertainty about redemption. The Verus team has not published a formal post-mortem, though community discussions on reimbursement and possible insurance coverage are already under way, according to AMBCrypto. For developers, the lesson reinforces what auditors have repeated since the 2022 Ronin and Wormhole breaches: validating message authenticity is not the same as validating value.
What comes next
Three near-term threads will shape the fallout. The Verus team is expected to issue a post-mortem and outline whether token holders will be made whole through a treasury draw or a community vote. Threshold Network, which issues tBTC, may need to coordinate with the bridge on tracing the stolen wrapped bitcoin before it is fully laundered. And regulators in both the United States and European Union are likely to point to the incident as further evidence that cross-chain infrastructure needs the same registration and reserve standards now being applied to centralized custodians under MiCA and pending US market-structure bills.
Frequently asked questions
How much was stolen from the Verus-Ethereum bridge?
The attacker drained approximately $11.58 million from the Verus-Ethereum bridge on May 18, 2026. The stolen assets consisted of 103.6 tBTC, 1,625 ETH, and 147,000 USDC, which the attacker then converted into roughly 5,402 ETH on decentralized exchanges within minutes of the breach.
What caused the Verus bridge hack?
The exploit came from a validation gap, not a traditional smart contract bug. The bridge verified state roots and transaction hashes between Verus and Ethereum but never confirmed that the input amount locked on Verus matched the payout amount released on Ethereum, allowing the attacker to claim funds they had not deposited.
What does the Tornado Cash link mean for the case?
On-chain analysts traced the attacker’s wallet to a 1 ETH withdrawal from Tornado Cash made about 14 hours before the attack. Because Tornado Cash is on the US Treasury’s OFAC sanctions list, any centralized exchange that processes the stolen ether could face compliance scrutiny, which often pressures attackers to abandon part of the haul.
