The Verus Ethereum Bridge was hit for a second time in two months, with an attacker pulling roughly $7.54 million in crypto assets from the same contract that was exploited back in May. Blockchain security firm Blockaid caught the attack on July 23, flagging it at 03:45 UTC.

According to onchain records, the exploit transaction swept about 1,137 ETH along with a handful of tokens, including tBTC, USDC, USDT, EURC, MKR and scrvUSD, all routed to a single attacker-controlled address: 0xCFd0A20703cD11E0b9f665e1C3F1Ef989C142D54. Etherscan confirmed the outflow value at roughly $7.54 million at the time of the transaction.

Blockaid's explanation is straightforward: the attacker abused the bridge's import path to trigger Ethereum-side payouts that had no matching assets locked on the source chain. In other words, funds flowed out without anything backing them. The firm described the July attack as involving the same bridge contract, the same entry path and the same bug class as the May incident, though a full technical post-mortem had not been published when the alert went out. A different wallet and transaction were used this time, suggesting a different actor or at least a fresh setup.

Two months, two exploits, one unfixed contract

The May breach cost the Verus bridge around $11.58 million. Researchers at the time identified a validation gap that let a forged cross-chain import pass verification even though the committed value on the source side didn't match what was paid out on Ethereum. That attacker later returned 4,052.4 ETH, worth about $8.5 million, after the project offered settlement terms, keeping 1,350 ETH as a bounty.

The July attack arrived roughly two months later, targeting what Blockaid called the same apparent vulnerability class. The fact that the contract was still live and reachable via the same entry path is the uncomfortable detail here. Thursday was a rough day for crypto security across the board: Lookonchain tallied combined losses from three separate exploits at roughly $35.55 million.

This article is for informational purposes only and does not constitute financial or investment advice.