Between April and May 2018, attackers exploited Verge's timestamp validation mechanism by mining blocks with spoofed timestamps set one hour in the past, forcing rapid difficulty adjustments. This allowed mining at inflated rates, generating counterfeit coins valued at ~$1.75M. The attackers manipulated multiple mining algorithms to maximize coin generation.

The attacker discovers and manipulates errors in the Verge code, causing false timestamps to be set on the block and then dig out new blocks quickly. The protocol of Verge is uses five mining algorithms in turn, and the attacker increases control over two of them: scrypt and lyra2re. The attack should be between block 2155850 and block 2206272. Within a few hours of the attack, the 35 million XVGs, which cost about $1.75 million, were stolen at the prevailing exchange rate.