Hacker exploits Verus-Ethereum bridge with fake transfer message, stealing over $11.5 million. Security firms flag missing validation.