A Verus-Ethereum (ETH) bridge attacker drained 103.6 tBTC, 1,625 ether and 147,000 USD Coin (USDC) on Monday, swapping the haul for over $11 million.

Verus Bridge Exploit Details

The attacker moved against the cross-chain bridge that lets users shift value between the Verus network and Ethereum, including ETH and ERC-20 assets, CoinDesk reported.

Blockchain analytics firm PeckShield flagged the incident on social media. The exploiter later swapped the stolen tokens for 5,402.4 ETH and now sits on the proceeds at address 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9.

The stolen tBTC is Threshold Network's tokenized Bitcoin (BTC). Verus had marketed its bridge as a non-custodial design backed by cryptographic proofs from miners and stakers, distinct from the multisig setups that have failed in past attacks.

Also Read: XRP ETFs Hit Record $1.39B But Token Loses 4th Spot To BNB

Bridge Attacks Keep Mounting

The Monday exploit fits a familiar pattern. Attackers keep hitting the infrastructure connecting chains rather than the smart contracts running on top of them.

Crypto exchange Phemex noted that the year's two largest losses, the $285 million Drift Protocol drain in April and the $292 million Kelp DAO breach later that month, both traced back to cross-chain components. Four of the smaller 2026 exploits also targeted bridge-related infrastructure.

"That is no coincidence, and it matches the historical pattern in which bridge exploits consistently produce the largest individual losses in any given year," the exchange said.

Cross-Chain Risk In 2026

Bridges remain crypto's softest target this year. The Kelp DAO attack in Apr. exploited LayerZero's cross-chain messaging system, releasing 116,500 rsETH to an attacker-controlled wallet and rippling damage across roughly 20 chains where wrapped ether collateral got stranded.

Drift's $285 million loss on Apr. 1 came not from a code bug but from compromised admin keys, with the stolen funds bridged to Ethereum through Circle's Cross-Chain Transfer Protocol before laundering. Total DeFi losses had already cleared $750 million by mid-April, per data from DefiLlama and PeckShield, with the Ronin Network's $552 million hack from 2022 still standing as one of the largest in crypto history.

Read Next: Hyperliquid Rejects Wall Street's Manipulation Claims As HYPE Drops 14%