CrossCurve Bridge Hacked for $3 Million

CrossCurve, a cross-chain liquidity protocol, has reported a significant security breach resulting in the theft of approximately $3 million. The incident occurred on February 1, prompting the team to issue an urgent security notice advising users to halt all interactions with the platform while an investigation is underway.

"Our bridge is under attack due to a vulnerability in one of the smart contracts. Please refrain from interacting with CrossCurve while we investigate," the developers stated.

According to security experts from Defimon Alerts, the attackers exploited a flaw in the ReceiverAxelar smart contract, allowing them to bypass gateway validation. This enabled them to invoke the expressExecute function with counterfeit cross-chain messages, triggering unauthorized token unlocks in the PortalV2 contract.

As a result, the pool balance plummeted from $3 million to nearly zero. CrossCurve, previously known as EYWA Protocol, operates as a decentralized exchange (DEX) and bridge, leveraging a Consensus Bridge mechanism designed to minimize the risk of simultaneous hacks across multiple protocols.

In a related development, Curve Finance, a collaborator on the project, issued a warning to its users about the incident. They advised individuals who have voted in EYWA-related pools to reconsider their positions and possibly withdraw their votes.

"Those who have delegated votes in EYWA-related pools should assess their positions and consider withdrawing those votes," the developers noted.

This hack comes on the heels of a series of attacks on decentralized platforms in January, raising concerns about the security of the crypto ecosystem. Immunefi CEO Mitchell Amador has previously highlighted that nearly 80% of crypto projects fail to recover after experiencing major breaches.