The Verus-Ethereum bridge has been hacked for a second time in about two months. Blockchain security firm Blockaid said the attacker on July 22 local time exploited the same vulnerability used in the May breach to steal $7.54 million worth of cryptocurrency.
Blockaid said on X that the attacker exploited a bridge route to induce unsecured payouts on the Ethereum side. The attacker withdrew ETH, tBTC, USDC, USDT, EURC, MKR and scrvUSD from bridge reserves and then converted the stolen assets into ETH.
Security firm CertiK also detected the hack and estimated losses at about $7.53 million. CertiK said the attacker withdrew funds through the Verus-Ethereum bridge, swapped the stolen assets into 3,916.1 ETH and deposited them into Tornado Cash.
Blockaid said the hack appeared to be linked to the Verus-Ethereum bridge attack disclosed in May. It said the same bridge contract, entry route and vulnerability type were used.
It added that while the method was the same, the latest hacker appeared to be a different person from the May attacker and received the funds in a newly created wallet.
Chi-gyu Hwang
delight@d-today.co.kr