Verus got most of its money back by cutting a deal with the thief. After roughly $11.5 million in crypto was stolen from the Verus–Ethereum bridge, the attacker returned 4,052 ETH — about $8.5 million, or roughly 75% of the haul. That happened after Verus publicly offered terms: send back most of the funds, keep a portion as a bounty. Under that deal, the exploiter kept 1,350 ETH, worth about $2.8 million.
Verus recovered most of the missing Ethereum because it agreed to let the attacker walk away with a sizable cut. Once funds have been moved on-chain, swapped, and split across wallets, projects often have one fast option left — make a deal and get back what they can.