A hacker who drained the Verus cross-chain bridge has returned 4,052 Ether (ETH) worth roughly $8.5 million, keeping the rest as a negotiated bounty.

Verus Bridge Hacker Returns Stolen ETH

The attacker behind the Verus-Ethereum bridge exploit sent 4,052.4 ETH back to the project's team wallet, blockchain security firm PeckShield confirmed on Friday.

That sum accounts for about 75% of the stolen funds.

The exploiter held onto 1,350 ETH, worth close to $2.8 million, as a bounty.

Verus had posted the offer a day earlier, agreeing to treat the retained ETH as a reward if the attacker sent back 4,052.4 ETH within 24 hours. The team also said it would drop all investigations once the attacker followed the terms.

The recovery comes days after the bridge was drained on May 18 in a forged cross-chain transfer that emptied reserves of more than $11.5 million.

Also Read: A Six-Year-Old Key Just Cost Polymarket $573K On Its Worst Friday

PeckShield Data Renews White-Hat Debate

The deal has reopened an argument that runs through DeFi security. Some developers back negotiated returns as practical damage control, while critics warn the arrangements may encourage more exploit attempts.

Security analysts say the Verus case stands out because the funds came back at all.

Many bridge exploits end with assets vanishing through mixers or staying frozen for good.

The technical failure is what unsettled researchers. The attacker built a Verus-side transaction that committed a hash of a payout blob while listing empty source totals, and the bridge paid out anyway.

Security firm Blockaid said the bridge verified everything it was built to verify. It simply never checked whether the source transaction backed the payout with real value.

Bridge Exploits Define a Hard 2026

Verus joins a long line of cross-chain casualties this year. DeFi hacks reached a cumulative $634 million in April, with the $280 million Drift Protocol breach and the $293 million Kelp exploit topping the month.

Losses have cooled since then, with DefiLlama data showing roughly $38 million stolen so far in May. Even so, hacks remain a stubborn drag on mainstream adoption.

Over the past decade, crypto thieves stole more than $17 billion across 518 recorded incidents, most of it traced to compromised private keys rather than the verification gaps that felled Verus.

Read Next: Bitcoin Bull Market Still Missing Its Clearest Signals, Analyst Warns