Attackers made off with $11.58 million from the Verus-Ethereum bridge this week, exploiting a missing validation check in a core function. The stolen haul – 1,625 ETH, 103.56 tBTC, and 147,000 USDC – was quickly swapped into roughly 5,402 ETH and moved to a separate wallet. The hack is the eighth bridge exploit recorded in 2025, with attackers having stolen at least $328 million from cross-chain bridges this year alone, according to PeckShield.
Inside the checkCCEValues bug
The vulnerability lived inside the function checkCCEValues, which failed to verify that the source-chain export amounts matched the payout amounts. That gap let the attacker inflate what they could claim on the Ethereum side. The technical breakdown from Blockaid noted that the exploit did not involve an ECDSA bypass, a compromised notary key, or parser/hash-binding bugs – just a missing source-amount validation.
One detail that stands out: the attack cost the hacker about $10 in VRSC fees, or roughly 0.02 VRSC. A tiny upfront expense for an $11.58 million payday.
Security firms flag the exploit
Blockchain security firms CertiK, PeckShield, and Blockaid all picked up and analyzed the incident. Blockaid provided the most detailed breakdown, explaining exactly how the missing check allowed the attacker to walk away with the funds. Their reports have been circulating widely on social media and within bridge security circles.
This isn't an isolated event. The prior month alone saw the crypto sector lose over $650 million to bad actors, with major hits on KelpDAO ($292 million) and Drift Protocol ($285 million). The bridge category has become a recurring wound for the industry.
VRSC price barely budged
The Verus native token, VRSC, remained largely flat on the day of the hack, trading at around $0.75. Over the past 30 days it's down 6%; over the last year it has lost 73% of its value. That flat reaction suggests the market either shrugged off the bridge exploit or the token was already beaten down enough to price in such risks.
With eight bridge hacks already in 2025 and total bridge losses climbing past $328 million, the question isn't whether another one will hit – it's which bridge's code will be the ninth to get picked apart.
