Verus Ethereum cross-chain bridge attacked, May DeFi losses exceed $20 million

Blockchain security company Blockaid monitored on May 18 that the Verus–Ethereum cross-chain bridge is being attacked and issued a warning on X; PeckShield confirmed that this attack caused an approximate loss of $11.58 million. According to DeFiLlama data, in May, 12 DeFi protocols were attacked, and the cumulative losses for May have already exceeded $20 million.

Confirmed Attack Details: Stolen Assets and On-Chain Tracking

（Source: Etherscan）

The breakdown of stolen assets disclosed by PeckShield is as follows:

· 103.6 tBTC

· 1,625 ETH

· 147,000 USDC

The stolen assets were then swapped into 5,402.4 ETH (about $11.4 million). They are currently still held in the attacker wallet address: 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9.

Source of funds (confirmed): About 14 hours before the attack, the attacker deposited 1 ETH via the Tornado Cash mixing service as initial funds to conceal the source of the funds.

Background on DeFi Security Incidents: May’s Chain-Reaction and Annual Data

May 15, 2026 (3 days ago): THORChain treasury was compromised; more than $10 million in protocol funds were stolen; THORChain said users’ account balances were not affected, and the investigation is ongoing.

May 2026 (before Verus): DeFiLlama confirmed that 12 DeFi protocols had already been attacked, and cumulative losses in May exceeded $20 million.

April 2026: 12 security incidents caused losses totaling over $606 million. Among them, the KelpDAO bridge vulnerability had a single-incident loss of $292 million, the largest single attack since 2026.

FAQ

Why did the attacker recharge the initial ETH via Tornado Cash?

Tornado Cash is an Ethereum mixing service based on zero-knowledge proofs. It severs the on-chain source of funds, making it more difficult to trace the attacker’s identity. Using a small amount of ETH (1 ETH) to top up is a common preparation step before cross-chain bridge attacks, used to pay Gas fees for subsequent operations while obscuring the origin of the funds.

Has the stolen 5,402.4 ETH been transferred yet?

According to reports, the stolen assets are still held in the attacker wallet 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9 and have not been transferred. As of the time of the report, the Verus project team had not published an official statement; whether the funds can be recovered depends on subsequent on-chain tracking and potential law-enforcement involvement.

How does DeFi security in May compare with April?

As of the Verus incident in May, cumulative losses have exceeded $20 million (12 incidents). By comparison, the total losses from 12 incidents in April reached $606 million (including KelpDAO’s $292 million). The scale of April was significantly higher than May’s current level, but the chain-reaction attack situation in May is still ongoing.