Verus bridge loses $7.54 million to a repeat exploit

An attacker drained roughly $7.54 million from the Verus Ethereum bridge, the second breach of the same system in just over two months. The exploit used the bridge's submitImports function to trigger payouts on Ethereum that were never backed by matching value committed on the Verus source chain. Seven assets left the bridge's Ethereum-side reserves: ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD.

Security firm Blockaid described the attack as related to the May incident that took about $11.58 million from the same system, citing the same bridge contract, the same entry path and the same class of bug. The independent researcher exvulsec confirmed the exploit signature within minutes of the drain.

B² Network disclosed a separate incident the same day. Unauthorised access to the upgrade authority on its staking contract let an attacker remove 8.59 million B2 tokens, worth about $3.86 million. The team suspended staking and said affected users would be compensated in full.

A bridge patched at the call site rather than at the accounting invariant leaves the second exploit cheaper to find than the first.