Verus-Ethereum Bridge Exploit Adds $11.58M to May DeFi Losses

Verus-Ethereum Bridge Exploit Drains $11.58 Million – May DeFi Losses Continue to Mount

Key Takeaways

• The Verus-Ethereum Bridge was reportedly exploited, with approximately $11.58 million in digital assets drained.
• Security firms Blockaid and PeckShield identified suspicious transactions and tracked the attacker’s wallet activity.
• Stolen assets included 103.6 tBTC, 1,625 ETH, and 147,000 USDC, later consolidated into 5,402.4 ETH.
• The attacker’s address was initially funded with 1 ETH via Tornado Cash around 14 hours before the exploit.
• May 2026 has already seen more than 12 DeFi incidents, with collective losses exceeding $20 million before the Verus case.

Verus-Ethereum Bridge Reportedly Drained for $11.58 Million

Multiple blockchain security firms reported that the Verus-Ethereum Bridge suffered a security breach on May 18, 2026. According to security company Blockaid, its exploit detection system identified an ongoing attack targeting the bridge. The firm stated that approximately $11.58 million had been drained at the time of its alert.

Security researchers identified the attacker’s externally owned account as 0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777. Blockchain security platform PeckShield provided further detail on the assets involved. It reported that the attacker withdrew approximately 103.6 tBTC, 1,625 ETH, and 147,000 USDC from the bridge.

PeckShield also noted that the stolen funds were subsequently swapped into 5,402.4 ETH, with a total value of around $11.4 million at the time of reporting. The consolidated funds were tracked to wallet address 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9, where they reportedly remain.

According to security researchers, the attacker’s address was initially funded with 1 ETH via Tornado Cash roughly 14 hours before the exploit. Tornado Cash is a crypto mixing service that can obscure transaction trails by pooling and redistributing funds.

Security Monitoring and On-Chain Tracking

The incident was first highlighted publicly through alerts issued by blockchain security firms monitoring on-chain activity. Blockaid stated that its exploit detection system flagged suspicious behavior connected to the Verus bridge. PeckShield independently tracked the asset flows and provided a breakdown of the tokens involved and their conversion into ETH.

The public identification of wallet addresses allows blockchain observers to monitor fund movements in real time. At the time of reporting, the converted ETH remained in the tracked wallet. No additional recovery or mitigation measures were detailed in the available information.

For users of decentralized finance protocols and cross chain bridges, such real time tracking underscores the transparency of blockchain transactions. At the same time, it highlights how quickly attackers can move and consolidate assets following a successful exploit.

Part of a Broader Pattern of May DeFi Exploits

The Verus bridge exploit adds to a growing list of decentralized finance incidents in May 2026. According to data from DeFiLlama, 12 DeFi protocols were hit earlier in the month before the Verus case. Collective losses had already surpassed $20 million prior to this incident.

The exploit also occurred three days after THORChain halted trading following a breach of one of its vaults. That incident reportedly drained more than $10 million in protocol owned funds. THORChain stated that user balances were not affected and that contributors were investigating the matter in cooperation with THORSec and external security partners.

While the Verus case and the THORChain incident are separate events, both contribute to a higher monthly total of DeFi related losses. The timing places additional attention on cross chain infrastructure and bridge mechanisms, which facilitate asset transfers between different blockchain networks.

April Set 2026 High With Over $606 Million in Losses

The increase in May follows a significantly larger wave of incidents in April 2026. During that month, DeFi protocols lost more than $606 million across 12 separate incidents. The largest single hack of the year so far was linked to the KelpDAO bridge drain, which accounted for $292 million.

Compared to April’s figures, May’s cumulative losses remain lower in absolute terms. However, the number of incidents reported in May indicates continued security challenges across decentralized protocols and cross chain bridges.

For users interacting with DeFi platforms, including those transferring assets between networks, bridge exploits remain a critical risk factor. The Verus incident illustrates how attackers can target bridging infrastructure to access pooled liquidity and rapidly convert assets.

Our Assessment

The reported $11.58 million exploit of the Verus-Ethereum Bridge increases the total number of DeFi security incidents recorded in May 2026. Blockchain security firms have identified the attacker’s wallet addresses and traced the movement and conversion of stolen funds into ETH. The event follows other recent breaches, including a vault incident at THORChain, and comes one month after April’s record losses of more than $606 million across DeFi protocols. Together, these incidents show that cross chain bridges and decentralized finance platforms continue to face recurring security breaches in 2026.