Blockaid Warns of $11.6 Million Asset Outflow in Verus-Ethereum Bridge Exploit

On the morning of May 18, 2026, security firm Blockaid issued an emergency alert regarding an exploit on the Verus-Ethereum bridge, where approximately $11.6 million in digital assets were drained. Security firm PeckShield also confirmed the breach, once again exposing the persistent vulnerabilities of cross-chain infrastructure in the decentralized finance (DeFi) sector.

According to Blockaid, the exploit is currently ongoing, with the attacker continuously draining funds by exploiting security loopholes in the bridge. Recorded as one of several bridge attacks throughout the first half of 2026, this incident has caused market concern as the total damages exceed $11.6 million.

Blockaid's exploit detection system identified an ongoing attack on the Verus-Ethereum bridge.

According to PeckShield's analysis, the assets drained from the bridge in this attack were confirmed to be 103.6 tBTC, 1,625 ETH, and 147,000 USDC. These assets constitute the core liquidity of the bridge's deposits, and the attacker transferred them to external wallets through multiple transactions. The specific breakdown of damages by asset is as follows.

Verus-Ethereum Bridge Structure and Vulnerabilities

The Verus-Ethereum bridge operates through the Bridge.vETH reserve system, where its value increases as fees or interest are added to the reserves without minting new tokens. This exploit is analyzed to have occurred by compromising the verification process or management rights of these reserve-based assets.

• Confirmation of unauthorized outflow of 103.6 tBTC
• Movement of 1,625 ETH in Ethereum assets
• Stablecoin loss amounting to 147,000 USDC

In 2026, bridge infrastructure is becoming a primary target for hackers, attributed to structural weaknesses in cross-chain message verification and poor human key management. Comparing this incident to the $6.7 million exploit of TrustedVolumes in early May provides a sense of the frequency and scale of recent security incidents.

In the seven days prior to this incident, the price of Verus Coin (VRSC) had already fallen by 6.41%, and as of May 18, 2026, market sentiment is expected to worsen further with the news of the exploit. Investors are monitoring the situation through official channels and waiting for countermeasures to prevent further asset outflows.

Technical Evolution of 2026 Security Incidents

Attackers in 2026 are showing a tendency to target larger scales of liquidity while repeating past vulnerabilities. In particular, as seen in the Hyperbridge case, methods of passing invalid proofs by exploiting flaws in proof verification logic are frequently observed.

Security experts advise users to frequently check wallet approval histories and verify the security audit history of protocols when using bridges. The Verus team is currently responding to block the drain, and users should refrain from using the bridge until an official announcement is made.

This Verus-Ethereum bridge incident is in line with the $5 million admin key theft that occurred at Wasabi Protocol in April 2026. Security in a cross-chain environment requires more complex verification procedures than a single chain, yet many projects still expose vulnerabilities in centralized management elements or verification logic.

Experts warn that this attack goes beyond a simple code error and could damage the overall reliability of bridge operations. In particular, the loss of $11.6 million directly harms liquidity providers within the Verus ecosystem, and significant difficulties are expected during the future recovery process.

As of May 18, 2026, the Verus team is reportedly suspending bridge functions or preparing security patches to prevent the spread of the attack. Users should check real-time updates from security firms such as PeckShield or Blockaid to ensure the safety of their assets.