Verus Exploit Attacker Returns $8.5M in ETH After Settlement Deal

TL;DR

• The Verus-Ethereum bridge exploiter returned 4,052 ETH, worth approximately $8.5 million, to a Verus team address.

• The bridge was drained for 103.6 tBTC, 1,625 ETH, and 147,000 USDC.

Attacker Returns Majority of Stolen Funds

An attacker linked to the recent exploit of the Verus network has returned 4,052.4 ETH—worth about $8.5 million—to the project’s wallet, following a negotiated settlement proposed by the platform’s core contributors.

Blockchain security firm PeckShield, citing onchain data, reported that the returned amount represents roughly 75% of the assets drained from the Verus-Ethereum bridge during the exploit.

#PeckShieldAlert The @veruscoin Bridge exploiter has returned 4,052.4 $ETH (~$8.5M) to the team address: 0xF9AB...C1A74.

The returned funds represent 75% of the stolen total, leaving a 25% bounty (1,350 $ETH, ~$2.8M) in the exploiter's wallet. https://t.co/ZFIqnHBwZk pic.twitter.com/vPsiOigyQ5

— PeckShieldAlert (@PeckShieldAlert) May 22, 2026

Despite the partial return, around 1,350 ETH (approximately $2.8 million) remains in the attacker’s possession and has been labeled a bounty under the settlement terms.

PeckShield also noted that the attacker has since moved the remaining funds to a separate wallet address.

The return came just hours after the Verus team publicly outlined a deal on X, offering the attacker a structured settlement.

Under the proposal, returning 4,052.4 ETH within 24 hours would lead to the community halting investigations, refraining from legal action, and avoiding extralegal pursuit.

To the Verus<->Ethereum Bridge Exploiter:
Members of the Verus community and its developers have discussed a set of terms, detailing the size of the bounty, obligations from your side and ours, and how the funds can be returned.

1. We have agreed that the bounty amount will be…

— Verus - The Internet of Value (@VerusCoin) May 21, 2026

“We will also post a public acknowledgement, referencing the 1,350 ETH and publicly state that we consider those funds to be your bounty,” the team said in its post.

The Verus-Ethereum bridge was compromised on May 18 at 11:55 p.m. UTC, according to a Discord announcement from the project.

The attacker drained ETH, USDC, and tBTC from the Ethereum-side contract before converting assets into Ethereum.

Verus Focuses on Recovery and Security Review

Following the exploit, the Verus team said it is prioritizing bridge hardening, additional audits, and community-driven recovery planning.

The project emphasized that it operates without venture capital backing and intends to handle the losses through decentralized governance processes.