CrossCurve Bridge misused for $3 million by way of spoofed cross-chain messages

• The attackers used spoofed cross-chain messages to bypass gateway validation and unlock funds.
• The exploit drained roughly $3 million from CrossCurve’s PortalV2 contracts throughout a number of networks.
• CrossCurve recognized 10 recipient wallets and enabled a ten% WhiteHat bounty coverage.

CrossCurve, the decentralized cross-chain liquidity protocol previously often called EYWA, has confirmed that its bridge infrastructure was exploited, resulting in losses of roughly $3 million.

This assault considerably will increase cryptocurrency theft. In January 2026 alone, practically $400 million was stolen throughout the business. Based on CertiK, greater than 40 main safety incidents have been recorded throughout the month.

Spoofed messages that bypass validation

The exploit focused a lacking validation examine in considered one of CrossCurve’s sensible contracts. Based on Defimon Alerts, anybody might probably name the ReceiverAxelar contract’s ExpressExecute perform utilizing a spoofed cross-chain message.

This bypassed gateway validation and triggered unauthorized token unlocking within the protocol’s PortalV2 contract. Arkham information exhibits PortalV2’s steadiness dropped from about $3 million to just about zero round January 31, as funds have been leaked throughout a number of networks.

BlockSec later estimated whole losses at roughly $2.76 million. Roughly $1.3 million was misplaced on Ethereum and $1.28 million on Arbitrum. Further losses have been additionally recorded in Optimism, Base, Mantle, Hippo, Flux, Cero, and Blast.

This exploit mechanism was just like the 2022 Nomad bridge failure. On this outage, funds have been quickly drained from a whole bunch of wallets resulting from flawed validation checks.

Emergency response and pockets identification

In response to this assault, CrossCurve issued an emergency discover asking customers to cease all interactions whereas the difficulty was investigated. The group later confirmed that that they had recognized 10 Ethereum addresses that obtained tokens originating from this exploit.

CrossCurve stated the funds have been obtained resulting from a flaw in a sensible contract and stated it doesn’t assume any malicious intent at this stage. The protocol invokes a secure harbor white hat coverage, providing as much as a ten% reward to events that return any remaining funds.

It additionally required direct reconciliation by way of e-mail and nameless repayments to designated wallets. Nevertheless, it warned that if Block 24364392 doesn’t contact us inside 72 hours and the funds should not returned, this incident can be handled as malicious.

Escalation measures embody felony referral, civil litigation, cooperation with centralized exchanges and stablecoin issuers to freeze belongings, public launch of pockets information, and cooperation with blockchain evaluation firms and legislation enforcement companies.

Associated: Truebit protocol hack information Uniswap charges in 100% TRU dump