CrossCurve Bridge Exploit Drains $3M as Protocol Urges Users to Stop Activity

Crypto protocol CrossCurve confirmed that its cross-chain bridge was attacked over the weekend, with about $3 million reportedly exploited across multiple blockchain networks. The incident adds to a growing list of bridge related breaches that continue to weigh on confidence in cross-chain infrastructure.

CrossCurve said late Sunday that its bridge was under attack due to the exploitation of a vulnerability in one of its smart contracts. The team urged users to immediately pause all interactions with the protocol while an internal investigation is underway.

Spoofed messages used to unlock tokens

Blockchain security alerts account Defimon Alerts, which is linked to security firm Decurity, reported that the exploit affected several networks and allowed the attacker to drain roughly $3 million in crypto assets.

According to Defimon Alerts, one of CrossCurve’s smart contracts contained a flaw that enabled anyone to spoof a cross-chain message. This allowed the attacker to bypass validation checks and unlock tokens without proper authorization.

“Anyone could call expressExecute on the ReceiverAxelar contract with a spoofed cross-chain message, bypassing gateway validation and triggering an unlock on PortalV2,” Defimon Alerts said in a post on X.

Following the disclosure, Curve Finance, which has partnered with CrossCurve, issued a warning to users involved with CrossCurve related pools. Curve said users who allocated votes to those pools may wish to review their positions and consider removing votes while the situation develops. The protocol also urged users to remain cautious when interacting with third party projects.

CrossCurve offers 10% bounty for fund return

CrossCurve CEO Boris Povar publicly shared a list of 10 wallet addresses that he said received tokens linked to the exploit. Povar appealed directly to the recipient addresses and offered a bounty of up to 10% if the funds are returned within 72 hours.

He added that the team does not believe the incident was intentional and stated there was no immediate indication of malicious intent.

Povar warned that failure to return the funds or make contact within 72 hours would force the protocol to treat the case as malicious. He said CrossCurve is ready to work with law enforcement and other crypto projects and authorities to freeze assets if needed.

At the time of writing, CrossCurve has not confirmed whether any funds have been returned. The protocol said further updates will be shared as the investigation progresses.