Flagged Live: Attacker Flips $11.5M in Stolen Verus Assets to ETH Following Tornado Cash Setup

3 weeks ago

A coordinated exploit drained astir $11.5 cardinal from the Verus-Ethereum span connected May 18, with information steadfast Blockaid linking the attacker’s wallet to Tornado Cash.

Key Takeaways

The Verus-Ethereum span mislaid $11.5M, with the attacker converting 103.6 tBTC, 1,625 ETH, and 147K USDC into ~5,402 ETH.
Blockaid flagged the Verus exploit successful existent time, and respective information firms confirmed the attacker’s wallet was seeded via Tornado Cash.
The onslaught is portion of a broader surge arsenic Peckshield has already tracked 8 span hacks totaling $328.6M during the archetypal fractional of May.

Attacker Converts Loot to ETH and Tornado Cash Trail Emerges

The Verus-Ethereum span was drained of astir $11.5 cardinal successful a coordinated exploit, with analytics confirming that the attacker extracted 103.6 tBTC, 1,625 ETH, and 147,000 USDC from the span earlier converting each stolen assets into astir 5,402 ETH (worth astir $11.4 million) held astatine wallet code 0x65Cb25F9.

Security steadfast Blockaid issued a assemblage alert identifying the onslaught arsenic it unfolded, subsequently confirming that the attacker’s wallet was initially seeded with 1 ETH via Tornado Cash, a decentralized cryptocurrency mixer that allows users to obscure the root of funds.

Tornado Cash has appeared successful respective post-exploit laundering trails of respective large crypto thefts successful caller years. In the Verus case, the single- ETH effect is accordant with a known signifier wherever attackers hole a cleanable wallet utilizing the mixer earlier moving, ensuring nary nonstop nexus betwixt their backing root and the onslaught address.

Verus is simply a proof-of-work and proof-of- stake hybrid blockchain focused connected privateness and self-sovereign identity. Its Ethereum span allows users to transportation assets betwixt the 2 networks to entree decentralized finance ( DeFi) protocols and output opportunities.

The velocity of plus conversion successful the Verus onslaught is notable arsenic each 3 plus types (namely wrapped bitcoin, ether, and stablecoins) were swapped into a azygous plus ( ETH) successful a abbreviated window, making traceability crossed chains minimal and simplifying the way to immoderate aboriginal laundering route.

The breach adds to an accelerating signifier of bridge-related losses successful 2026, with Certik labelling April’s question of attacks arsenic a “high-stakes shift” successful cross-chain cybercrime tactics, wherever attackers are targeting span verification weaknesses astatine an unprecedented scale. Side by side, Peckshield has tracked 8 span exploits done the archetypal 2 weeks of May, totaling $328.6 million.

The Verus incidental is the astir caller summation to that moving tally.

View source