Verus-Ethereum Bridge Exploited for $11.58 Million in May
The Verus-Ethereum Bridge suffered a security breach on May 18, 2026, with attackers draining approximately $11.58 million in digital assets, as reported by blockchain security firms Blockaid and PeckShield. The exploit involved the theft of 103.6 tBTC, 1,625 ETH, and 147,000 USDC, which were then swapped into 5,402.4 ETH (worth ~$11.4 million) and held in the attacker's wallet: 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9. The attacker's address was initially funded with 1 ETH via Tornado Cash approximately 14 hours prior to the attack. This incident follows a separate breach of THORChain on May 15, where over $10 million in protocol-owned funds were drained from a vault, though user balances were reportedly unaffected. According to DeFiLlama data, Verus is the 13th DeFi protocol hit in May 2026, pushing the month's total losses above $20 million. This comes after April 2026, which saw over $606 million lost across 12 incidents, including the $292 million KelpDAO bridge drain.
Key facts
- Verus-Ethereum Bridge drained of ~$11.58 million on May 18, 2026.
- Stolen assets: 103.6 tBTC, 1,625 ETH, 147,000 USDC, swapped to 5,402.4 ETH.
- Attacker funded via Tornado Cash 14 hours before exploit.
- THORChain also suffered $10M+ vault breach on May 15.
- May 2026 DeFi losses top $20M after 13 protocol exploits.