Blockaid Traces $11.58 Million Verus-Ethereum Bridge Drain to Missing Source-Amount Check
Blockaid said a missing source-amount validation was the suspected root cause of the roughly $11.58 million drain on the Verus-Ethereum Bridge. The firm said the bridge verified notarized state roots, Merkle proofs and the hash of serialized transfers, but did not verify that source-chain export totals actually backed the payouts, which let an attacker submit an import on Ethereum and draw funds from bridge reserves.
Earlier alerts had put the loss at about $11.4 million to $11.58 million. CertiK said the outflow included 1,625.36 ETH, 103.56 tBTC and 147.65K USDC. Blockaid said the exploit was not an ECDSA bypass, notary key compromise or parser/hash-binding bug, and estimated the attacker's cost at about $10 in VRSC fees.
From the sources (8 posts)
@blockaid_🚨 Community alert: Blockaid's exploit detection system has identified an on-going exploit on the @veruscoin Verus-Ethereum Bridge ( ~$11.58M drained so far. More details in🧵
@peckshieldHi @veruscoin It seems abnormal assets outflow (~$11.4m) from Verus-Ethereum Bridge: The funds are currently parked in the following address:
@wublockchainBlockaid: Verus-Ethereum Bridge Under Attack, $11.58M Drained So Far Security firm Blockaid issued a community alert saying its exploit detection system identified an ongoing attack on the Verus-Ethereum Bridge, with approximately $11.58 m
@certikalert#CertiKInsight 🚨 We have seen a suspicious transaction that drained ~$11.4M (1625.36 ETH + 103.56 tBTC + 147.65K USDC) assets from the @VerusCoin Verus-Ethereum bridge contract at 0x71518580f36feceffe0721f06ba4703218cd7f63. Stay Vigilant
@cointelegraph🚨 ALERT: Blockaid has detected an ongoing exploit on the Verus-Ethereum Bridge, with approximately $11.58M drained so far.
@peckshieldalert#PeckShieldAlert The @veruscoin Verus-Ethereum Bridge has been drained for 103.6 $tBTC, 1.625K $ETH, and 147K $USDC. The exploiter swapped the stolen assets for 5,402.4 $ETH (~$11.4M), which currently sits in 0x65Cb8b128Bf6e690761044CCECA4
@blockaid_@VerusCoin 🔎 Verus-Ethereum Bridge $11.58M drain - Suspected root cause Same class as Wormhole-2022 / Nomad-2022: source ↔ destination economic-value binding gap. What the bridge correctly verifies: ✓ Notarized Verus state root (8/15 vali
@certikRT @CertiKAlert: #CertiKInsight 🚨 We have seen a suspicious transaction that drained ~$11.4M (1625.36 ETH + 103.56 tBTC + 147.65K USDC) a…