CrossCurve Bridge Hacked for $3 Million

On February 1, the team behind the cross-chain liquidity protocol CrossCurve reported a security breach.

“Our bridge is under attack, involving the exploitation of a vulnerability in one of the smart contracts. Please refrain from interacting with CrossCurve while we investigate the incident,” the developers wrote.

Security experts from Defimon Alerts discovered that hackers bypassed the gateway verification in a smart contract named ReceiverAxelar.

The attackers invoked the expressExecute function by sending spoofed cross-chain messages. This allowed them to bypass validation and unauthorizedly unlock tokens in the PortalV2 contract.
According to Arkham Intelligence, the pool’s balance plummeted from $3 million to nearly zero.
CrossCurve (formerly EYWA Protocol) is a cross-chain DEX and bridge developed in collaboration with Curve Finance. Its architecture is based on the Consensus Bridge mechanism, which distributes transaction verification risks among independent protocols: Axelar, LayerZero, and its own network of oracles EYWA.
The project has frequently touted this approach as a key advantage, claiming that “the likelihood of multiple cross-chain protocols being hacked simultaneously is close to zero.”
In September 2023, Curve Finance founder Michael Egorov became an investor in the platform. Later, the project secured $7 million in venture funding.
The Curve Finance team commented on the breach by issuing a warning to users.

“Those who have delegated votes to EYWA-related pools should assess their positions and consider withdrawing those votes,” the developers noted.