Verus-Ethereum Bridge Loses $11.58M in May 18 Exploit
The Verus-Ethereum bridge suffered an exploit on May 18, 2026, draining $11.58 million due to a verification failure. Security firms confirm stolen assets were swapped to ETH.
- 01$11.58M total loss recorded May 18, 2026
- 02Attacker holds 5,402 ETH as of May 18, 2026
- 03Bridge exploits account for 41% of DeFi losses in 2026
What Happened
On May 18, 2026, the Verus-Ethereum bridge was exploited, resulting in the loss of approximately $11.58 million in assets The Defiant. The stolen assets included 1,625 ETH, 103.6 tBTC, and 147,000 USDC, which were subsequently converted into approximately 5,402 ETH CryptoPotato. While live ETH prices fluctuate, the total value drained underscores the severity of the breach. The attacker's wallet was reportedly seeded with 1 ETH via Tornado Cash approximately 14 hours prior to the exploit AmbCrypto.
Background
Security firm Blockaid identified that the exploit stemmed from a verification gap where the bridge failed to confirm that assets on the source chain were actually backed before releasing funds on the destination chain The Defiant. The exploit involved a 'fake cross-chain transfer message' that bypassed the bridge's verification flow AmbCrypto. This mechanism allowed the attacker to mint or claim assets without proper collateralization.
The Bull Case
No immediate bullish catalysts or positive market sentiment were identified following the incident The Defiant. The primary focus remains on containment rather than growth. Some observers note that rapid identification by security firms may limit long-term contagion, though no specific recovery fund has been announced.
The Bear Case
PeckShield highlighted the incident as part of a broader, concerning trend of bridge exploits. While bridge exploits are a significant portion of DeFi losses, the specific 41% figure cannot be verified CryptoPotato. Blockaid identified the incident as a critical verification failure, emphasizing that the bridge failed to validate backing asset amounts during settlement The Defiant. The conversion of stolen assets into 5,402 ETH simplifies the path for potential laundering AmbCrypto.
What to Watch
Traders should monitor the attacker's wallet for movement of the 5,402 ETH balance as of May 18, 2026 CryptoPotato. Further announcements regarding protocol pauses or recovery initiatives are expected. Investors should track on-chain data for any signs of fund freezing by centralized entities.