On July 23, 2026 (second of two exploits in 66 days), Verus-Ethereum Bridge was drained of $7.54M via the import path; a small 0.01 VRSC transaction triggered unbacked ETH/tBTC payouts due to missing deposit verification. The vulnerability repeated from May and was never patched.

The Verus Ethereum Bridge was exploited again. The attacker abused the bridge’s import path to trigger unbacked payouts on the Ethereum side, draining approximately $7.54 million in assets (ETH, tBTC, USDC, etc.) from the bridge reserves. This is the second exploit of the same flaw from May. The project has not issued a detailed official statement yet.