Verus Bridge Exploiter Returns 4,052 ETH, Keeps $2.8M as Negotiated Bounty

The attacker behind the May 18 Verus-Ethereum bridge exploit has returned 4,052.4 ETH — roughly $8.5 million, or 75% of the drained funds — to the project's wallet, following a public settlement framework the Verus core team posted on X. The remaining 1,350 ETH, worth approximately $2.8 million, stays with the attacker as an agreed bounty, per onchain data cited by PeckShield.

The Verus team had offered clear terms: return 4,052.4 ETH within 24 hours and the community would halt investigations, refrain from pressing charges, and publicly acknowledge the retained 1,350 ETH as a legitimate bounty. The attacker complied within hours. The team had not formally confirmed the return at press time.

The original exploit, confirmed at 11:55 p.m. UTC on May 18, saw the attacker drain ETH, USDC, and tBTC from the Ethereum contract — later swapped into roughly 5,402 ETH worth about $11.4 million,…