Batch-transfer flaw exploited to drain roughly $11.6M from Verus–Ethereum bridge

Security firm Blockaid issued an alert saying its exploit-detection system identified an ongoing attack on the Verus–Ethereum bridge, with roughly $11.58 million reportedly drained so far ^{[1] [2] [3]}.

Blockchain monitors reported the attacker stole 103.6 tBTC, 1,625 ETH and 147,000 USDC, and swapped the haul for roughly 5,402 ETH, valuing the proceeds at just over $11 million ^{[4] [3] [2]}.

Analysis from GoPlus indicated the attacker used a low-value transaction to trigger a batch-transfer of bridge reserves, enabling the drain; the incident was active at time of reporting ^{[3] [1]}.

Security firms are continuing to track the incident and the totals remain subject to change as on-chain activity and investigations proceed ^{[1] [3]}.