The Verus-Ethereum Bridge lost about $11.58 million on May 18, 2026, after an attacker submitted a transfer with $0.01 of inputs on the Verus side and walked off with 1,625 ETH, 147,659 USDC, and 103.57 tBTC v2 on Ethereum. Security firm Blockaid flagged the abnormal outflow at roughly 00:54 UTC, then watched the attacker swap everything into about 5,402 ETH and park it in a wallet that, as of publication, still holds the funds. The root cause was a missing line of validation in a single Solidity function, and the attack adds another entry to a 2026 ledger of bridge losses that has now passed $328 million.
A blockchain bridge is a system that lets users move assets from one blockchain to another by locking the original token on the source chain and releasing a wrapped version on the destination chain. Bridges remain the most exploited category of DeFi infrastructure because that lock-and-release model concentrates billions of dollars behind a small amount of code.
Key takeaways
- An attacker drained roughly $11.58 million from the Verus-Ethereum Bridge on May 18, 2026, by submitting a forged transfer with only $0.01 of inputs.
- The flaw sat in the bridge’s
checkCCEValuesfunction on the Ethereum side, which never compared the source amount to the payout amount. - Stolen funds (1,625 ETH, 147,659 USDC, 103.57 tBTC v2) were converted into about 5,402 ETH and have not yet moved from the attacker’s wallet.
- The hack is the eighth major bridge breach of 2026, pushing combined cross-chain losses past $328 million for the year.
Published: May 20, 2026, 13:30 UTC
What happened on the Verus bridge
The exploit unfolded in minutes. According to Crypto Briefing and CoinDesk, the attacker funded their wallet (0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777) with 1 ETH routed through Tornado Cash about 14 hours before the strike. At 00:54 UTC, Blockaid flagged unusual outflows from the bridge contract. By the time the alert spread, the attacker had drained three assets and was already converting them on a decentralized exchange.
The transfer that triggered the payout was technically valid on Verus. The notary network on the Verus side received a state root, a hash tied to a real transfer blob, and a working Merkle proof. Every signature checked out. The blob itself, though, carried inputs worth about one cent. On the Ethereum side, the bridge contract took the verified blob and released the matching ETH, USDC, and tBTC outputs without ever comparing the two amounts.
The missing line of code
Security researchers at Halborn and PeckShield traced the bug to a function called checkCCEValues in the bridge’s Ethereum contract. The function was supposed to confirm that the value coming in from Verus matched the value going out on Ethereum. It checked structure. It checked proofs. It did not check that the two dollar amounts were equal.
Halborn described the gap as a “missing source-amount validation” that could be patched with roughly ten lines of Solidity. That estimate is the most uncomfortable part of the story for Verus users. An $11.58 million loss came down to a parity check that was assumed but never written.
Why bridges keep losing money
Cross-chain bridges have been the worst-performing category of DeFi infrastructure since 2022, when the Ronin and Wormhole hacks together cost users over $930 million. The pattern has not improved. DefiLlama data shows at least eight major bridge breaches between February and mid-May 2026, including the $292 million KelpDAO drain via its LayerZero-powered bridge in April. Combined 2026 bridge losses now stand at about $328.6 million.
The structural problem is that bridges have to translate trust between two systems that do not share a consensus mechanism. Each side validates its own piece of the transfer. When the two sides do not exchange enough information about the other, an attacker can satisfy one validator while lying to the other. That is exactly what happened with Verus.
What comes next for Verus users
As of publication, the Verus development team has not issued an official statement on next steps. There has been no announcement about pausing the bridge, compensating depositors, or coordinating with exchanges to freeze the stolen ETH. The attacker wallet still holds the funds, which gives Verus and on-chain investigators a narrow window to negotiate or pressure custodians if the funds move to a centralized venue.
For users with assets bridged through Verus, the practical questions are whether wrapped balances on Ethereum are still backed and whether withdrawals will be honored once the contract is patched. Until the team responds, those holding bridged tBTC v2, wrapped USDC, or wrapped ETH on Verus rails should treat exposure as uncertain.
For the broader market, expect another round of audits across bridge contracts that share Verus’s architecture. Industry voices who pushed for stricter bridge standards after the KelpDAO hack now have a fresh case. The fix Halborn recommends, payload-to-execution validation with pause functions on anomalous imports, is a small change that would have stopped this attack in a single block.
Frequently asked questions
How much was stolen from the Verus-Ethereum Bridge?
The attacker drained about $11.58 million, made up of 1,625 ETH, 147,659 USDC, and 103.57 tBTC v2. The assets were converted into roughly 5,402 ETH on a decentralized exchange and, as of May 20, 2026, remain in the attacker’s wallet.
What caused the Verus bridge hack?
The bridge’s Ethereum contract did not verify that the input value on the Verus side matched the payout value on Ethereum. Researchers traced the flaw to the checkCCEValues function, which validated proofs and structure but skipped a numerical parity check. About ten lines of Solidity would have closed the gap.
Are bridge hacks getting worse in 2026?
Yes. At least eight major bridge exploits between February and mid-May 2026 have produced combined losses of about $328.6 million, including the $292 million KelpDAO breach in April. Cross-chain validation logic remains the most consistently exploited surface in DeFi.
