The Verus Bridge has been attacked again: a second hack in two months has taken $7.54 million.
The Ethereum bridge Verus has once again fallen victim to a cyberattack — this time, the damage amounts to approximately $7.54 million. The incident occurred on July 23, just two months after the previous hack, when the protocol lost $11.5 million.
Vulnerability in the Import Path
Analysis revealed that the hacker exploited the same flaw in the import mechanism as in May. The attacker initiated unbacked payouts on the Ethereum side, bypassing standard checks. As a result of the attack, assets in ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD were withdrawn.
Repetition of the Scenario
Notably, the hack was carried out through the same contract, using an identical vulnerability class and entry point. This indicates that previous security measures were insufficient to fully eliminate the issue. Likely, the Verus team did not conduct a thorough audit or left unresolved logical errors in the code.
My Conclusions
Such repeated attacks on the same protocol are a warning signal for the entire DeFi market. If developers do not address the root cause of the vulnerability, rather than just patching surface-level holes, user trust in the bridge will be completely undermined. Under current circumstances, I recommend temporarily avoiding interaction with Verus until a detailed security report is published and comprehensive fixes are implemented.