Verus-Ethereum bridge exploit uses forged Merkle proof, $11.5M stolen
On May 18, the Verus-Ethereum bridge exploit reportedly drained about $11.5M after attackers used a forged Merkle proof.
According to PeckShieldAlert, the attacker took 103.6 tBTC, 1,625 ETH, and about 147,000 USDC from the bridge contract. The funds were then swapped into about 5,402.4 ETH and reportedly consolidated into a single wallet.
Blockaid said the Verus-Ethereum bridge correctly verified notarized state roots (8/15 notaries), but still failed to properly bind destination-chain value to the source-chain proof. Security researcher “evilcos” also said a forged Merkle proof could pass the bridge’s validation. Verus had released an “urgent and mandatory” emergency patch (v1.2.14-2) two days earlier, but it’s unclear whether it prevented this specific weakness.
For traders, the Verus-Ethereum bridge exploit reinforces that cross-chain bridge verification remains a key security risk. The broader backdrop is worsening: bridge-related losses reached about $328.6M (eight major incidents through mid-May). Even if this does not directly hit spot fundamentals, it can drive short-term risk-off sentiment toward cross-chain DeFi assets and liquidity.
Bearish
The Verus-Ethereum bridge exploit highlights a repeatable bridge-verification failure pattern: even when notarized state roots validate, the system can still miss proper binding between source-chain proofs and destination-chain value. That tends to renew concerns about the safety of cross-chain custody and liquidity, which can pressure cross-chain DeFi sentiment in the short term.
While the stolen assets may be quickly swapped and does not necessarily change long-term protocol fundamentals for unrelated tokens, the news flow adds to already high bridge-loss totals (~$328.6M with eight major incidents through mid-May). Historically, similar bridge incidents often lead traders to reduce exposure to connected bridges, wrapped assets, and liquidity pools until audits and mitigations are confirmed.