Verus Ethereum Bridge — Repeat import-path unbacked payout exploit

Timeline: On May 18, 2026, the Verus Ethereum Bridge suffered its first exploit ($11.58M) via the submitImports import path. The attacker accepted a 25% white-hat bounty and returned 4,052.4 ETH. On July 8, 2026, Verus redeposited the recovered ETH into the same bridge contract — without patching the underlying flaw. On July 23, 2026 at approximately 03:45 UTC, a second (different) attacker exploited the identical vulnerability: submitting a fraudulent import claim via the same submitImports path triggered the Ethereum-side contract to release bridge reserves without verifying matching value on the Verus chain. The attacker drained approximately $7.54M in a mixed basket of ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD. All assets were consolidated into ~3,916 ETH via on-chain DEX swaps and routed through Tornado Cash. Blockaid and CertiK issued alerts within minutes of the exploit. As of July 25, no official post-mortem had been published by VerusCoin, no bridge pause announcement was issued, and no recovery was reported.