VerusBridge exploit analysis
VerusBridge's precommit verified against a source-chain root while settling against the destination's full bridge balance, allowing a forged precommit to drain about $11.58M in one transaction.
- Reported loss
- ~$11.58M, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-17: Insufficient Validation on VerusBridge”.
Analysis1 min read
VerusBridge's cross-chain transfer validation read the source-chain transaction's preimage from a pre-anchored precommit, but the precommit's Merkle path validation ran against a different chain root than the one used for the destination's settlement. The attacker constructed a precommit that verified against the source root but settled against the destination's full bridge balance.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0x6990f01720f57fc515d0e976a0c4f8157e0a9529194c4c15d190e98d087eb321 on Etherscan for a total loss of about $11.58M.
What would have prevented it: a Merkle path validation that compares the precommit against the destination's precommit root, with the destination settling against the same precommit.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260517-verusbridge---merkle-path-validation-against-source-root-settles-destination
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/VerusBridge_exp.sol
- https://etherscan.io/tx/0x6990f01720f57fc515d0e976a0c4f8157e0a9529194c4c15d190e98d087eb321
Other exploits
- ElevateFi exploit analysis 19 May 2026
- TesseraSwap exploit analysis 18 May 2026
- SEAToken exploit analysis 17 May 2026
- AdsharesBridge exploit analysis 15 May 2026
- SQTokenStaking exploit analysis 12 May 2026
- HumaFinance exploit analysis 11 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
