Verus-Ethereum Bridge has suffered a second exploit in just about two months after an attacker drained roughly $7.54 million in crypto assets on Wednesday by exploiting the same vulnerability class used in the protocol's May breach, according to blockchain security firm Blockaid.
In a post on X, Blockaid said the attacker abused the bridge's import path to trigger unbacked Ethereum-side payouts, draining ETH, tBTC, USDC, USDT, EURC, MKR, and scrvUSD from bridge reserves before converting the stolen assets into ETH.
Blockchain security firm CertiK also flagged the exploit, estimating losses at approximately $7.53 million.
The firm said the attacker withdrew the funds through the Verus-Ethereum bridge, later swapped the stolen assets for 3,916.1 ETH and deposited the proceeds into Tornado Cash.
Meanwhile, Blockaid said the latest exploit appears related to the Verus-Ethereum bridge attack disclosed in May, citing the same bridge contract, entry path and vulnerability class, while noting the transaction was carried out by a different attacker using a new loot wallet.
