DeFi protocol Verus is facing an ongoing exploit targeting its Ethereum bridge that has drained roughly $11.58 million so far, according to multiple blockchain security firms.
In a late Sunday post on X, onchain security platform Blockaid reported the attack, identifying the attacker's address as "0x5aBb…D5777." The stolen funds were stored in wallet address "0x65C…C25F9," Blockaid wrote.
Blockchain security firm Peckshield reported that the Verus-Ethereum bridge has been drained for 103.6 tBTC, 1,625 ETH, and 147,000 USDC. It added that the attacker subsequently swapped the stolen assets for 5,402 ETH, worth about $11.4 million.
Peckshield also noted that the attacker's address was initially funded with 1 ETH via Tornado Cash about 14 hours ago.
GoPlus, another security company, also flagged that the attacker appeared to have sent a low-value transaction to the bridge contract and called a specific function to have the bridge contract batch-transfer the reserve assets to the drainer.
