Ongoing exploit drains $11.6 million from Verus-Ethereum bridge: Blockaid

DeFi protocol Verus is facing an ongoing exploit targeting its Ethereum bridge that has drained roughly $11.58 million so far, according to multiple blockchain security firms.

In a late Sunday post on X, onchain security platform Blockaid reported the attack, identifying the attacker's address as "0x5aBb…D5777." The stolen funds were stored in wallet address "0x65C…C25F9," Blockaid wrote.

Blockchain security firm Peckshield reported that the Verus-Ethereum bridge has been drained for 103.6 tBTC, 1,625 ETH, and 147,000 USDC. It added that the attacker subsequently swapped the stolen assets for 5,402 ETH, worth about $11.4 million.

Peckshield also noted that the attacker's address was initially funded with 1 ETH via Tornado Cash about 14 hours ago.

GoPlus, another security company, also flagged that the attacker appeared to have sent a low-value transaction to the bridge contract and called a specific function to have the bridge contract batch-transfer the reserve assets to the drainer.

"It is highly likely to be cross-chain message validation/signature forgery, withdrawal logic bypass, or access control flaw," said GoPlus.

The Verus team said in its Discord channel that the Verus network has halted, "with most block-generating nodes taking themselves offline after encountering byproducts of the attack as designed."

"Developers are investigating exactly how the attack was carried out and determining next steps," the team added.

The Block has reached out to the team for further comment.

Verus is a privacy-oriented blockchain protocol launched in 2018, and uses a hybrid proof-of-power consensus combining proof-of-work and proof-of-stake. It launched the Verus-Ethereum bridge in October 2023, enabling users to transfer and convert assets between the Verus network and Ethereum. 

This is a developing story.