Flagged Live: Attacker Flips $11.5M in Stolen Verus Assets to ETH Following Tornado Cash Setup

📄Full Article· Automatically extracted by trafilatura2309 words

A coordinated exploit drained approximately $11.5 million from the Verus-Ethereum bridge on May 18, with security firm Blockaid linking the attacker’s wallet to Tornado Cash. Flagged Live: Attacker Flips $11.5M in Stolen Verus Assets to ETH Following Tornado Cash Setup Key Takeaways Attacker Converts Loot to ETH and Tornado Cash Trail Emerges The Verus-Ethereum bridge was drained of approximately $11.5 million in a coordinated exploit, with analytics confirming that the attacker extracted 103.6 tBTC, 1,625 ETH, and 147,000 USDC from the bridge before converting all stolen assets into approximately 5,402 ETH (worth roughly $11.4 million) held at wallet address 0x65Cb25F9. Security firm Blockaid issued a community alert identifying the attack as it unfolded, subsequently confirming that the attacker’s wallet was initially seeded with 1 ETH via Tornado Cash, a decentralized cryptocurrency mixer that allows users to obscure the origin of funds. Tornado Cash has appeared in several post-exploit laundering trails of several major crypto thefts in recent years. In the Verus case, the single- ETH seed is consistent with a known pattern where attackers prepare a clean wallet using the mixer before moving, ensuring no direct link between their funding source and the attack address. Verus is a proof-of-work and proof-of- stake hybrid blockchain focused on privacy and self-sovereign identity. Its Ethereum bridge allows users to transfer assets between the two networks to access decentralized finance ( DeFi) protocols and yield opportunities. The speed of asset conversion in the Verus attack is notable as all three asset types (namely wrapped bitcoin, ether, and stablecoins) were swapped into a single asset ( ETH) in a short window, making traceability across chains minimal and simplifying the path to any future laundering route. The breach adds to an accelerating pattern of bridge-related losses in 2026, with Certik labelling April’s wave of attacks as a “high-stakes shift” in cross-chain cybercrime tactics, where attackers are targeting bridge verification weaknesses at an unprecedented scale. Side by side, Peckshield has tracked eight bridge exploits through the first two weeks of May, totaling $328.6 million. The Verus incident is the most recent addition to that running tally.

Data Status✓ Full text extractedRead Original (Bitcoin.com)

🔍Historical Similar Events· Keyword + Asset Matching6 items

2026-04-29

Kyberswap Exploiter Moves 2,900 ETH to Tornado Cash Two Years After $65M Heist

2026-04-23

Kelp DAO exploiter launders nearly all 75,700 in stolen ETH through THORchain

Similarity 300%標的 ETH關鍵字 stolen/eth

2026-04-23

KelpDAO Attacker Launders 75,700 ETH Into Bitcoin in Day-and-a-Half Sprint

Similarity 300%標的 ETH關鍵字 attacker/eth

2026-05-27

Ethereum Traders Grow Increasingly Bearish as ETFs Bleed, ETH Sinks Near $2,000