Verus attacker returns 4,052 ETH, keeps 1,350 ETH bounty

An attacker connected to a May 18 exploit of the Verus–Ethereum bridge returned 4,052.4 ETH, roughly $8.5 million, to the project’s wallet on Thursday under a negotiated settlement. The attacker retained 1,350 ETH, about $2.8 million, as a bounty.

Verus core contributors posted terms on X offering to halt investigations, refrain from pressing charges and avoid extralegal action if the attacker returned 4,052.4 ETH within 24 hours. The post also promised a public acknowledgement referencing the retained funds as the attacker’s bounty: “We will also post a public acknowledgement, referencing the 1,350 ETH and publicly state that we consider those funds to be your bounty.”

On-chain security firm PeckShield reported the return and traced the remaining 1,350 ETH to a new wallet address. Blockchain records show the returned ETH reached the project wallet hours after the Verus post. Verus had not published a formal acknowledgement of the return at the time of reporting.

The bridge was compromised on May 18 at 11:55 p.m. UTC when an attacker withdrew ETH, USDC and tBTC from the bridge’s Ethereum contract. Security platform Blockaid estimated total losses at $11.58 million. PeckShield reported the bridge was drained of about 103.6 tBTC, 1,625 ETH and 147,000 USDC, and that the attacker later swapped those assets for 5,402 ETH, valuing the haul at roughly $11.4 million. The 4,052.4 ETH returned represents 75% of that amount.

Verus reported focusing on hardening the bridge, conducting additional audits and developing a recovery plan through its decentralized community, which it described as operating without venture capital backing.