The Verus↔Ethereum bridge was drained for a second time. The attacker spent 0 ETH on the Ethereum side and forged a single cross-chain import. The root cause is one line that was never written: the bridge checked that the data was intact, but never that the withdrawal was backed by equal value.