The Verus-Ethereum Bridge was drained for a second time on July 23, with attackers walking away with between $7.3 million and $7.5 million in digital assets. The same vulnerability exploited on May 17, when thieves took roughly $11.6 million, had gone unpatched for 66 days. Combined losses now sit at approximately $19.1 million.
What the attackers actually did
The attack came through a maliciously crafted import originating on the Verus side, which included an unbacked payout request settled on Ethereum. The bridge dutifully verified notary signatures, state roots, and Merkle proofs. None of that mattered. It never checked whether the payout amount corresponded to assets actually locked or exported on the Verus side.
Backward Labs, which published a full report and proof-of-concept after the incident, traced the root cause to an authorization bypass combined with a protocol-state assumption failure. The bridge accepted a proven import authorizing multi-asset reserve payouts, but upstream checks covering creation, authorization, transfer hash, count, and economic backing were all insufficient. The firm's summary was blunt: "This time, the same root cause remained exploitable for 66 days."
Assets pulled from reserves included Ether, tBTC, MKR, USDC, Tether, EURC, and scrvUSD. For DAI, the bridge tapped a Sky (formerly MakerDAO) collateral position and minted roughly 220,357 DAI to satisfy the fraudulent request. Multiple on-chain monitoring tools flagged the transaction immediately, citing state manipulation, arbitrary minting, and abnormal DeFi outflows.
The broken invariant, as Backward Labs put it: "Ethereum bridge reserves may be released only for source-chain reserve transfers whose CCE creation, authorization, transfer hash, count, and economic backing are all proven under the expected bridge lifecycle." In this case, none of those conditions were enforced in practice.
How the security community is responding
Cross-chain bridge exploits have become a reliable line item in DeFi loss reports. The pattern here, cryptographic proof passing while business-logic validation for asset backing fails, is exactly the kind of gap that makes bridges attractive targets. Verification of signatures and Merkle proofs sounds rigorous, but it means nothing if the economic layer underneath is never checked.
Bridge exploits across the industry hit $328.6 million in May alone, according to PeckShield tracking of eight major incidents that month. The Verus case adds to a growing argument that state-check logic needs the same engineering attention as cryptographic primitives. Users affected by the July 23 breach are being directed to official Verus channels for updates on any recovery efforts, though blockchain transactions are immutable and full recovery in cases like this is rare.
This article is for informational purposes only and does not constitute financial or investment advice.
