Verus-Ethereum Bridge — Cross-chain Verification Bypass

Timeline: On 18 May 2026 around 00:54 UTC, Blockaid detected the active exploit on the Verus-Ethereum Bridge. The attacker submitted a Verus transaction spending ~$0.01 in VRSC fees with a transfer blob containing empty source totals, signed by 8/15 notaries. The proof was then submitted to the Ethereum contract via submitImports() and the bridge paid out ~$11.58M in ETH, tBTC and USDC without validating that source totals match destination payouts (flaw in checkCCEValues, ~10 missing Solidity lines per Blockaid). Drained assets: 1,625 ETH + 103.6 tBTC + ~147,659 USDC, converted into 5,402 ETH. On 22 May 2026, PeckShield confirmed the return of 4,052.4 ETH (~$8.5M, 75% of the total) to the Verus team following a whitehat negotiation; 1,350 ETH (~$2.8M) kept as bounty. Same bug class as Wormhole-2022 and Nomad-2022: missing source↔destination economic link, correct cryptographic validation but missing economic validation.