CrossCurve Hit by $3M Exploit in Cross-Chain Bridge Breach

Crypto News Exploits

CrossCurve Hit by $3 Million Exploit in Cross-Chain Bridge Breach

Written by Aaron S.,

Editor-In-Chief

Last Updated: February 02, 2026

Key Takeaways

CrossCurve suffered a $3 million exploit due to a flaw in its cross-chain bridge smart contract;
Defimon Alerts said attackers bypassed validation on the ReceiverAxelar contract to unlock funds;
CEO Boris Povar offered a 10% bounty for returning stolen tokens within 72 hours before legal action.

Stop overpaying - start transferring money with Ogvio. Sign up, invite friends & grab Rewards now! 🎁

CrossCurve Hit by $3 Million Exploit in Cross-Chain Bridge Breach

BITDEGREE IN YOUR SOCIAL FEED

CrossCurve confirmed that its cross-chain bridge was targeted by a cyberattack, which resulted in about $3 million in losses.

In a post on X on February 1, the team said a vulnerability in one of its smart contracts had been exploited and urged users to stop using the platform while it investigates.

Security researcher account Defimon Alerts, linked to Decurity, reported that the exploit took place across multiple blockchains.

What is Algorand? ALGO Coin Explained With Animations

Did you know?

Want to get smarter & wealthier with crypto?

Subscribe - We publish new crypto explainer videos every week!

It explained, "Anyone could call expressExecute on ReceiverAxelar contract with a spoofed cross-chain message, bypassing gateway validation and triggering unlock on PortalV2".

Following the disclosure, Curve Finance, a partner of CrossCurve, advised users to check whether they were involved in related pools. It said that anyone who had allocated votes to CrossCurve pools “may wish to review their positions and consider removing those votes".

To address the issue, CrossCurve’s CEO, Boris Povar, shared that ten wallet addresses were involved and requested that the funds be returned within 72 hours. He said, "These tokens were wrongfully taken from users due to a smart contract exploit. We do not believe this was intentional on your part, and there is no indication of malicious intent".

He also offered a reward of up to 10% of the recovered funds. However, he warned that if there was no response or return within the 72-hour window, the team would treat the case as intentional theft and pursue legal action.

Matcha Meta reported a security issue on January 25 involving one of its main liquidity partners, SwapNet. How did the incident happen? Read the full story.