cryptd.in

LinkedIn alternativ pentru talentele cripto-friendly

Hacker Steals Over $11M From Verus-Ethereum Bridge

-

de

cryptd.in
în

Hackers have reportedly drained $11.58 million from the Verus-Ethereum bridge.

According to alerts from various blockchain security platforms, the exploit hit one of Verus’ cross-chain bridge contracts and emptied reserves containing ETH, tBTC, and USDC.

How the Attack Worked

Two of the firms, CertiK and PeckShield, flagged suspicious activity from the bridge contract at 0x71518580…cd7f63 within hours of the exploit.

Per their posts on X, the stolen assets totaled 1,625 ETH, 103.56 tBTC, and 147,000 USDC, with the attacker quickly swapping everything into approximately 5,402 ETH and parking the funds in a separate wallet.

Another on-chain security firm, Blockaid, published a technical breakdown shortly after, and it is the clearest account of what went wrong.

According to them, the bridge correctly checked three things: a notarized Verus state root signed by eight of fifteen notaries, a Merkle proof of the cross-chain export, and a hash binding confirming the integrity of the transfer data. However, what it did not check was whether the source-chain export’s stated amounts actually matched what it was about to pay out.

The attacker reportedly built a transaction on the Verus side for roughly 0.02 VRSC, which is about $0.01 at current prices, that committed a keccak hash of a payout blob while listing empty source-side totals. The Verus protocol accepted it as legitimate, and the notaries signed the resulting state root without issue, because from their perspective, nothing was wrong.

On the Ethereum side, the attacker called submitImports() with a serialized transfer blob whose hash matched the committed value, so the bridge verified the hash, decoded the blob, and paid out 1,625 ETH, 103 tBTC, and 147,000 USDC from its reserves to the attacker.

In a nutshell, it cost the attacker about $10 in VRSC fees for a return of $11.58 million. Per the Blockaid report, there was no ECDSA bypass, no compromise of notary keys, and no parser or hash-binding bug.

The vulnerability was a missing source-amount validation in a function called “checkCCEValues,” which, according to the security firm, would take around ten lines of Solidity to fix.

Bridge Exploits Are on the Rise

Last month, according to Certik, the wider crypto sector lost more than $650 million to bad actors, with a huge chunk of that amount coming from just two incidents: an attack on KelpDAO that led to the theft of more than $292 million and another on Drift Protocol, which lost over $285 million.

Bridges are also being increasingly targeted, with the Verus exploit being the eighth incident involving such platforms this year, and according to PeckShield, their attackers have made off with at least $328 million.

Meanwhile, looking at the market, VRSC, the Verus native token, didn’t seem to have reacted to the news of the exploit. Data from CoinGecko shows that it was largely flat on the day of the hack, having barely moved in the 24-hour window heading into the attack.

At the time of writing, it was trading at around $0.75, down 6% in 30 days, while in the last year it has lost close to 73% of its value.

Postul Hacker Steals Over $11M From Verus-Ethereum Bridge a apărut prima dată pe CryptoPotato.

Comentarii

Lasă un răspuns

Adresa ta de email nu va fi publicată. Câmpurile obligatorii sunt marcate cu *

Ultimele fluxuri

Categorii populare

ro_RO Română
ro_RO Română en_US English et Eesti ko_KR 한국어 ja 日本語 ru_RU Русский de_DE Deutsch es_ES Español zh_CN 简体中文 fr_FR Français zh_TW 繁體中文 pt_PT Português it_IT Italiano pl_PL Polski tr_TR Türkçe nl_NL Nederlands id_ID Bahasa Indonesia el Ελληνικά uk Українська bg_BG Български cs_CZ Čeština fi Suomi hu_HU Magyar lv Latviešu valoda lt_LT Lietuvių kalba nb_NO Norsk bokmål sk_SK Slovenčina sl_SI Slovenščina sv_SE Svenska

Căutați pe site

Povești populare

Etichete

#AlexeyPertsev (1) #BidenCryptoBan (1) #BidenElecție (1) #BinanceVsCoinbase (1) #Bitcoin (442) #BitcoinETF (3) #BitcoinFundamente (1) #BitcoinHandling (1) #BitcoinPrice (5) #BitcoinPriceLevel (1) #BitcoinPump (1) #BitcoinReserve (1) #BitcoinSurge (1) #BitcoinTop (1) #Bitfinex (1) #Bitwise (1) #BracebridgeCapital (1) #BRC20Tokens (1) #BTCachiziție (1) #BullishPrediction (1) #BullishSentiment (1) #CincianăMiniere (1) #CPIPreview (1) #CryptoAsset (2) #CryptoBattle (1) #CryptoBoom (1) #CryptoExpert (1) #CryptoInsights (1) #CryptoMania (1) #CryptoMarket (4) #CryptoPrediction (1) #CryptoPrediciuni (1) #CryptoReglementare (2) #CryptoTakeoff (1) #CryptoTiming (1) #CryptoTips (1) #CryptoTreasury (1) #CryptoIncertitudine (1) #DerivativeJump (1) #Dogecoin (74) #DogecoinGains (1) #DogecoinVolumele (1) #DutchCourt (2) #ECommerce (1) #ElSalvadorBitcoin (1) #Ethereum (70) #EthereumPain (1) #EthereumPrice (1) #ExpertOpinion (1) #FedRateCut (1) #FiatCurrency (1) #Fimpact financiar (1) #FinanciarPrivire privată (1) #FirmShutdown (1) #F Contul înghețat (1) #IllicitFunds (1) #InflationData (1) 1TP5Investiții (1) 1TP5Pierdere din investiții (1) #JaponezăFirmă (1) #Acțiune juridică (1) #Impact juridic (1) #Legislație (1) #LightningNetwork (1) #MAnaliză de piață (3) #MMonitorizare de piață (1) #MPredicție de piață (1) #MPrediciții de piață (1) #Mproiecție de piață (1) #MarketSupport (1) #MVolatilitatea pieței (1) #MCăsătorie (1) #MemeCoin (5) #MemeCoins (2) #MinerProfitabilitate (1) #MSpălare de bani (2) #MtGox (4) #N Coreea de NordCrypto (1) #NovogratzPredicție (1) #PriceMilestone (1) #PPrețPredicție (2) #Price Întrebare (1) #PriceSurge (1) #PrisonSentință (1) #QuantAnalysis (1) #ReglementarePresiune (1) #SECAntiCrypto (1) #ShibaInu (6) #SocialBuzz (1) #TAnaliză tehnică (1) #Toncoin (3) #TornadoCash (3) #TornadoCashDev (1) #TornadoCashDeveloper (1) #UKCrypto (1) #UpsidePotențial (1) #USCongresul (1) #WyomingLand (1) #XRPPrice (1) #XRPupswing (1)

Link-uri utile

Link-uri pe care le-am găsit utile și pe care am dorit să le împărtășesc.