Verus Coin loses $7.5 million due to validation error

Blockchain security firm SlowMist warns of a serious exploit on the Verus Coin network. An attacker managed to steal approximately $7.5 million worth of crypto assets from Verus Coin’s bridge. The attack exploits a critical flaw in the validation of cross-chain transactions, causing verified payments to be released without adequate economic backing.

How the attack worked

The hack targets the VerusProof.checkExportAndTransfers function, which validates cross-chain transfers. Although this function verified certain fields of the CCE (Cross-Chain Element), the checks bypassed many crucial economic parameters. The attacker exploited this gap by submitting a counterfeit CCE linked to an accepted Verus state root. This CCE contained a hash commitment of eight attacker-defined reserve transfers.

Because the bridge did not verify whether the economic fields of the CCE actually supported these transfers, the system executed eight payouts from the bridge custody to an attacker-controlled address. In this way, stablecoins such as USDT, USDC and DAI were stolen, along with ETH and four other tokens.

Earlier vulnerability at the same location

This is not the first incident where Verus Coin faces issues with cross-chain import validation. In a previous exploit (0x6990…b321), the system decoupled the verified proof from the executed transfer payload. Both attacks point to the same underlying architectural problem: the bridge simply does not properly validate whether the specified previous CCE output contained sufficient value and assets to cover the claimed transfers.

SlowMist reports that the attacker address is 0xbda71b58cec0b1c20a8f87ccd52fa0679747855c and that the exploit funds were sent to 0xcfd0a20703cd11e0b9f665e1c3f1ef989c142d54. The affected bridge is 0x71518580f36feceffe0721f06ba4703218cd7f63. For full technical details, SlowMist refers to their analysis on their website.