
PeckShield tracked 103.6 tBTC, 1,625 ETH, and 147K USDC stolen from the Verus bridge. The $11.58M was consolidated into 5,402.4 ETH. The attacker wallet remains active and holds the funds.
Alpha Score of 41 reflects weak overall profile with weak momentum, weak value, moderate quality, weak sentiment.
The tally of decentralized finance exploits in May continued to climb after the Verus-Ethereum Bridge reportedly suffered a security breach. Attackers drained roughly $11.58 million in digital assets. Multiple blockchain security firms flagged the exploit on Monday, warning users about suspicious activity linked to the bridge.
The Verus loss arrives three days after THORChain halted trading. A breach of one vault drained over $10 million in protocol-owned funds. THORChain said user balances were not affected. DeFiLlama data shows that 12 DeFi protocols were hit in May 2026 before Verus. Collective losses already exceed $20 million this month.
Blockchain security company Blockaid flagged the exploit in a post on X. Security researchers identified the attacker’s externally owned account (EOA) as 0x5aBb91B9c01A5Ed3aE762d32B236595B459D5777. PeckShield said the attacker drained three distinct assets before consolidating into a single token:
The stolen assets were swapped into 5,402.4 ETH, valued at around $11.4 million. The funds remain in the wallet: 0x65Cb8b128Bf6e690761044CCECA422bb239C25F9. “The attacker’s address was initially funded with 1 ETH via Tornado Cash ~14 hours ago,” a PeckShield post read. That obfuscation tactic is standard: exploiters use the mixer to break the on-chain trail before launching the attack.
The direct exposure is limited to users who had assets locked in the Verus-Ethereum Bridge at the time of the exploit. Verus has not confirmed whether user funds are fully covered or whether the protocol will issue reimbursements. Recovery rates in similar bridge hacks vary widely. Some protocols have fully restored funds via treasury or insurance. Others have left users with permanent losses.
DeFiLlama data shows that 12 DeFi protocols were hit in May 2026 before Verus. Collective losses already topped $20 million before the Verus and THORChain incidents. Adding the $11.58 million from Verus and the $10 million+ from THORChain brings the May total to over $31.5 million. April 2026 set the year’s benchmark, with protocols losing more than $606 million across 12 incidents.
| Month | Number of Incidents | Total Losses | Largest Single Hack |
|---|---|---|---|
| April 2026 | 12 | $606M | KelpDAO bridge ($292M) |
| May 2026 (to date) | 13 | >$31.5M | Verus Bridge ($11.58M) |
Note: May total includes Verus and THORChain. THORChain’s loss was protocol-owned, not user funds.
Beyond the stolen assets, the broader crypto market may see indirect pressure. Bridge exploits often lead to a short-term dip in Ethereum and Bitcoin as liquidators sell collateral or LPs exit positions. The Verus bridge is relatively small compared to major protocols, so systemic contagion is unlikely. Still, three assets deserve attention.
May 2026 is on track to be the second-worst month for DeFi hacks this year, behind only April. The concentration of bridge exploits – Verus, THORChain, KelpDAO – points to a structural weakness in cross-chain infrastructure. Bridges rely on complex smart contract logic to lock and mint assets across chains, creating a large attack surface. Bridge risk is not diversifiable by holding multiple tokens. The vulnerability sits at the infrastructure layer.
Traders who use bridges for arbitrage or yield farming should treat each bridge as a separate counterparty risk. For watchlists, the key question is whether Verus will survive the exploit. The protocol’s response in the next 48 hours will determine whether this is a one-off loss or a terminal event. Monitor the attacker wallet and Verus’s official channels for updates.
For broader context on DeFi lending hack losses and the crypto market, see DeFi Lending Hack Losses: $3 per $10,000 Deposited and our crypto market analysis.
Prepared with AlphaScala research tooling and grounded in primary market data: live prices, fundamentals, SEC filings, hedge-fund holdings, and insider activity. Each story is checked against AlphaScala publishing rules before release. Educational coverage, not personalized advice.