# Verus Bridge $7.54M Forged Import Exploit

> The Verus-Ethereum bridge was drained of $7.54M via a forged cross-chain import on July 23, 2026, two weeks after it refilled reserves recovered from May's $11.58M hack of the same import path.

Source: https://defimon.xyz/blog/verus-bridge-hack-july-2026 · Published: 2026-07-23 · Network: Ethereum · Impact: $7.54M

---

## TLDR

On July 23, 2026, at 03:45 UTC, the Verus-Ethereum bridge was drained of approximately $7.54 million when an attacker pushed a forged cross-chain import through the bridge's Delegator contract on Ethereum, releasing reserves that were never backed by matching exports on the Verus side. The stolen assets, roughly 1,137 ETH along with tBTC, MKR, USDC, USDT, DAI, EURC, and scrvUSD, were swapped into about 3,900 ETH and deposited into Tornado Cash. It is the second time in two months this bridge lost funds through the same contract, the same entry path, and the same vulnerability class: a May attack took about $11.58 million, most of which was returned under a public bounty deal, redeposited into the bridge on July 8, and drained again two weeks later. Defimon's public alert channel flagged the July attack transaction in real time.

## Technical Analysis

The Ethereum side of the Verus bridge is a contract known as the Delegator, which custodies the bridge's Ethereum-side reserves and processes imports: batches of cross-chain transfers exported from the Verus chain, submitted together with notarization data and a proof that the batch was finalized on Verus. When an import passes proof verification, the Delegator pays the referenced recipients out of its reserves.

The attacker invoked the import path, reported as the `submitImports()` function, with crafted import and notarization data whose proof passed the contract's verification even though no corresponding export existed on the Verus chain. Investigators reported that the flaw sat before cross-chain transfer validation and found no evidence of validator key or credential compromise, which distinguishes this incident from custody-style bridge failures. In the taxonomy of [cross-chain bridge exploits](/blog/bridge-exploits-explained), this is a message verification bug: the destination contract accepted a message the source chain never produced.

The attack transaction landed at 03:45:59 UTC in block 25592836. On-chain data confirms a single call from the attacker's address into the Delegator, with every resulting token transfer directed to one recipient wallet:

- Attack transaction: `0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099`
- Attacker (transaction sender): `0xbda71b58cec0b1c20a8f87ccd52fa0679747855c`
- Attacker recipient wallet: `0xcfd0a20703cd11e0b9f665e1c3f1ef989c142d54`
- Verus Delegator bridge contract (victim): `0x71518580f36feceffe0721f06ba4703218cd7f63`
- May return transaction (4,052 ETH): `0xb428dae60a234c149c8bc4468979356c434726bf8f588b6c97bd7144aa5bcefe`
- July 8 redeposit transaction: `0x31441634d048239a75ae071149cb01d812689530d75c8ce21b927b1aeaf183a7`

The transaction emitted transfers of tBTC, DAI, MKR, USDC, USDT, EURC, and scrvUSD to the recipient wallet, alongside the native ETH payout. Analysis of both incidents indicates the July exploit used the same bridge contract, entry path, and vulnerability class as the May attack, but was executed by a different attacker operating a fresh wallet.

The May precedent is what turns this from an exploit into an indictment. In mid-May, a forged cross-chain import passed verification despite mismatched values between the source side and the Ethereum payout, netting roughly $11.58 million that the attacker consolidated into about 5,402 ETH. The Verus community publicly offered 1,350 ETH for the vulnerability disclosure, and on May 21 the attacker sent 4,052 ETH back to the designated recovery address, an on-chain transfer recorded in the transaction list above, keeping the rest as a de facto bounty. Verus stated afterward that it strengthened transaction proof verification on the bridge. On July 8, a transaction against the same Verus recovery address moved the recovered funds back under bridge control. Two weeks later, the refilled reserves went out through the same door. Security researcher Taylor Monahan compressed the whole arc into four lines:

> May 17: Verus Bridge hacked for 5402.4 ETH.
>
> May 21: The attacker returned 4052.4 ETH. (25% bounty, ...)
>
> July 8: Verus Bridge put the money back in the Verus Bridge.
>
> July 22: Verus Bridge hacked for 3,816 ETH.
>
> — [Taylor Monahan (@tayvano_) on X](https://x.com/tayvano_/status/2080156365411258737)

The July 22 date in that timeline reflects US time; on-chain, the drain landed at 03:45 UTC on July 23.

Defimon's pipeline flagged the drain as it happened and streamed it as structured JSON, the same machine-readable format documented in the [WebSocket attack message reference](/docs/websocket_attack_message):

```json
{
  "network": "mainnet",
  "attack_type": "suspicious_large_transfer",
  "transaction_hash": "0xa1f1e65c1cea4dba4ae439cd4dcdba6cc2dbda0ed1228e61f29ae9c9324eb099",
  "attacker_address": "0xbda71b58cec0b1c20a8f87ccd52fa0679747855c",
  "victim_address": "0x71518580f36feceffe0721f06ba4703218cd7f63",
  "balance_change": -7330000.0
}
```

## Impact Assessment

External estimates put the July loss at approximately $7.54 million. Defimon's real-time alert measured a $7.33 million balance change on the flagged transaction. The drained reserves spanned eight assets: ETH, tBTC, MKR, and the stablecoins USDC, USDT, DAI, EURC, and scrvUSD. The attacker converted the haul into about 3,900 ETH and deposited it into Tornado Cash, which sharply reduces the odds of recovery through negotiation or tracing.

Taken together, the two incidents removed roughly $19 million from the same bridge contract inside two months, with about $8.5 million of the May loss later returned. For bridge users, the more damaging fact is structural: reserves restored after the first settlement were exposed to a vulnerability class that had already been publicly exercised, documented, and negotiated over.

## Response and Recovery

The May incident ended in a settlement: the attacker returned 4,052 ETH, around $8.5 million at the time, and retained 1,350 ETH as a de facto whitehat bounty after the Verus community published a return address and a deadline. No comparable outcome had emerged for the July attack at the time of writing. The funds moved to Tornado Cash rather than sitting in an attacker-controlled wallet, and the assessment that this is a different actor makes a repeat negotiation less likely.

The sequence that preceded the second drain is what has the security community talking. The vulnerability class was publicly known, publicly negotiated over, and publicly paid for in May. The bridge was then refilled with the recovered funds on July 8 and emptied again fifteen days later through the same entry path. That timing has fed open speculation among researchers that the July incident could be a rug pull rather than an independent external exploit. There is no on-chain evidence of insider involvement, and the transaction pattern is equally consistent with a second attacker exploiting a documented weakness that was never fully fixed. But a bridge that reloads its treasury behind a known-broken lock invites exactly this question, and the burden of answering it now sits with the Verus team.

The pattern here is one of the most common in bridge security: an exploited path that is patched, audited, or hardened, then exploited again along the same trust boundary. A bridge's Ethereum-side contract is a standing honeypot whose solvency depends entirely on what its proof verifier accepts, and any weakness in that verifier tends to be rediscovered. Continuous monitoring of the bridge contract for anomalous imports and payouts is the remaining defense when prevention fails, because the window between the attack transaction and irreversible laundering is measured in minutes.

## Frequently Asked Questions

**What happened to the Verus Ethereum bridge?**

On July 23, 2026, an attacker submitted a forged cross-chain import to the Verus bridge's Delegator contract on Ethereum and drained about $7.54 million in ETH, tBTC, MKR, and stablecoins without any matching export on the Verus chain. The stolen assets were swapped into about 3,900 ETH and deposited into Tornado Cash.

**Was this the first Verus bridge hack?**

No. The same bridge lost about $11.58 million in May 2026 through the same contract, entry path, and vulnerability class. That attacker returned 4,052 ETH after public negotiations and kept 1,350 ETH as a bounty. The recovered funds were moved back into the bridge on July 8 and drained again two weeks later by a different actor using a fresh wallet.

**How was the Verus bridge exploited?**

The bridge's import path accepted crafted import and notarization data whose proof passed verification even though the referenced transfers were never exported from the Verus side, so the Delegator contract paid out unbacked reserves. Investigators reported no evidence of validator key compromise; the failure was in proof verification, the message verification class of bridge exploit.

**Was the second Verus bridge hack a rug pull?**

There is no proof either way. The timing, with recovered funds redeposited into the bridge on July 8 and drained two weeks later through the same known entry path, has fueled speculation among security researchers that the incident could be a rug pull. The on-chain evidence is equally consistent with a different attacker exploiting a documented weakness that was never fully fixed.